GoogleOauth2.0 First implementation

First try for GoogleOauth2.0

express-server/app.js

@@ -10,6 +10,8 @@ var users = require('./routes/users');
 
 var app = express();
 
+
+
 // view engine setup
 app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'ejs');

express-server/node_modules/.bin/gp12-pem

@@ -0,0 +1,15 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -x "$basedir/node" ]; then
+  "$basedir/node"  "$basedir/../google-p12-pem/build/src/bin/gp12-pem.js" "$@"
+  ret=$?
+else 
+  node  "$basedir/../google-p12-pem/build/src/bin/gp12-pem.js" "$@"
+  ret=$?
+fi
+exit $ret

express-server/node_modules/.bin/gp12-pem.cmd

@@ -0,0 +1,7 @@
+@IF EXIST "%~dp0\node.exe" (
+  "%~dp0\node.exe"  "%~dp0\..\google-p12-pem\build\src\bin\gp12-pem.js" %*
+) ELSE (
+  @SETLOCAL
+  @SET PATHEXT=%PATHEXT:;.JS;=;%
+  node  "%~dp0\..\google-p12-pem\build\src\bin\gp12-pem.js" %*
+)

express-server/node_modules/.bin/semver

@@ -0,0 +1,15 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -x "$basedir/node" ]; then
+  "$basedir/node"  "$basedir/../semver/bin/semver" "$@"
+  ret=$?
+else 
+  node  "$basedir/../semver/bin/semver" "$@"
+  ret=$?
+fi
+exit $ret

express-server/node_modules/.bin/semver.cmd

@@ -0,0 +1,7 @@
+@IF EXIST "%~dp0\node.exe" (
+  "%~dp0\node.exe"  "%~dp0\..\semver\bin\semver" %*
+) ELSE (
+  @SETLOCAL
+  @SET PATHEXT=%PATHEXT:;.JS;=;%
+  node  "%~dp0\..\semver\bin\semver" %*
+)

express-server/node_modules/.bin/uuid

@@ -0,0 +1,15 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*) basedir=`cygpath -w "$basedir"`;;
+esac
+
+if [ -x "$basedir/node" ]; then
+  "$basedir/node"  "$basedir/../uuid/bin/uuid" "$@"
+  ret=$?
+else 
+  node  "$basedir/../uuid/bin/uuid" "$@"
+  ret=$?
+fi
+exit $ret

express-server/node_modules/.bin/uuid.cmd

@@ -0,0 +1,7 @@
+@IF EXIST "%~dp0\node.exe" (
+  "%~dp0\node.exe"  "%~dp0\..\uuid\bin\uuid" %*
+) ELSE (
+  @SETLOCAL
+  @SET PATHEXT=%PATHEXT:;.JS;=;%
+  node  "%~dp0\..\uuid\bin\uuid" %*
+)

express-server/node_modules/agent-base/.travis.yml

@@ -0,0 +1,23 @@
+sudo: false
+
+language: node_js
+
+node_js:
+  - "4"
+  - "5"
+  - "6"
+  - "7"
+  - "8"
+  - "9"
+
+install:
+  - PATH="`npm bin`:`npm bin -g`:$PATH"
+  # Install dependencies and build
+  - npm install
+
+script:
+  # Output useful info for debugging
+  - node --version
+  - npm --version
+  # Run tests
+  - npm test

express-server/node_modules/agent-base/History.md

@@ -0,0 +1,113 @@
+
+4.2.0 / 2018-01-15
+==================
+
+  * Add support for returning an `http.Agent` instance
+  * Optimize promisifying logic
+  * Set `timeout` to null for proper cleanup
+  * Remove Node.js <= 0.11.3 special-casing from test case
+
+4.1.2 / 2017-11-20
+==================
+
+  * test Node 9 on Travis
+  * ensure that `https.get()` uses the patched `https.request()`
+
+4.1.1 / 2017-07-20
+==================
+
+  * Correct `https.request()` with a String (#9)
+
+4.1.0 / 2017-06-26
+==================
+
+  * mix in Agent options into Request options
+  * throw when nothing is returned from agent-base callback
+  * do not modify the options object for https requests
+
+4.0.1 / 2017-06-13
+==================
+
+  * add `this` context tests and fixes
+
+4.0.0 / 2017-06-06
+==================
+
+  * drop support for Node.js < 4
+  * drop old versions of Node.js from Travis-CI
+  * specify Node.js >= 4.0.0 in `engines.node`
+  * remove more old code
+  * remove "extend" dependency
+  * remove "semver" dependency
+  * make the Promise logic a bit cleaner
+  * add async function pseudo-example to README
+  * use direct return in README example
+
+3.0.0 / 2017-06-02
+==================
+
+  * drop support for Node.js v0.8 and v0.10
+  * add support for async, Promises, and direct return
+  * add a couple `options` test cases
+  * implement a `"timeout"` option
+  * rename main file to `index.js`
+  * test Node 8 on Travis
+
+2.1.1 / 2017-05-30
+==================
+
+  * Revert [`fe2162e`](https://github.com/TooTallNate/node-agent-base/commit/fe2162e0ba18123f5b301cba4de1e9dd74e437cd) and [`270bdc9`](https://github.com/TooTallNate/node-agent-base/commit/270bdc92eb8e3bd0444d1e5266e8e9390aeb3095) (fixes #7)
+
+2.1.0 / 2017-05-26
+==================
+
+  * unref is not supported for node < 0.9.1 (@pi0)
+  * add tests to dangling socket (@pi0)
+  * check unref() is supported (@pi0)
+  * fix dangling sockets problem (@pi0)
+  * add basic "ws" module tests
+  * make `Agent` be subclassable
+  * turn `addRequest()` into a named function
+  * test: Node.js v4 likes to call `cork` on the stream (#3, @tomhughes)
+  * travis: test node v4, v5, v6 and v7
+
+2.0.1 / 2015-09-10
+==================
+
+  * package: update "semver" to v5.0.1 for WebPack (#1, @vhpoet)
+
+2.0.0 / 2015-07-10
+==================
+
+  * refactor to patch Node.js core for more consistent `opts` values
+  * ensure that HTTP(s) default port numbers are always given
+  * test: use ssl-cert-snakeoil SSL certs
+  * test: add tests for arbitrary options
+  * README: add API section
+  * README: make the Agent HTTP/HTTPS generic in the example
+  * README: use SVG for Travis-CI badge
+
+1.0.2 / 2015-06-27
+==================
+
+  * agent: set `req._hadError` to true after emitting "error"
+  * package: update "mocha" to v2
+  * test: add artificial HTTP GET request test
+  * test: add artificial data events test
+  * test: fix artifical GET response test on node > v0.11.3
+  * test: use a real timeout for the async error test
+
+1.0.1 / 2013-09-09
+==================
+
+  * Fix passing an "error" object to the callback function on the first tick
+
+1.0.0 / 2013-09-09
+==================
+
+  * New API: now you pass a callback function directly
+
+0.0.1 / 2013-07-09
+==================
+
+  * Initial release

express-server/node_modules/agent-base/README.md

@@ -0,0 +1,145 @@
+agent-base
+==========
+### Turn a function into an [`http.Agent`][http.Agent] instance
+[![Build Status](https://travis-ci.org/TooTallNate/node-agent-base.svg?branch=master)](https://travis-ci.org/TooTallNate/node-agent-base)
+
+This module provides an `http.Agent` generator. That is, you pass it an async
+callback function, and it returns a new `http.Agent` instance that will invoke the
+given callback function when sending outbound HTTP requests.
+
+#### Some subclasses:
+
+Here's some more interesting uses of `agent-base`.
+Send a pull request to list yours!
+
+ * [`http-proxy-agent`][http-proxy-agent]: An HTTP(s) proxy `http.Agent` implementation for HTTP endpoints
+ * [`https-proxy-agent`][https-proxy-agent]: An HTTP(s) proxy `http.Agent` implementation for HTTPS endpoints
+ * [`pac-proxy-agent`][pac-proxy-agent]: A PAC file proxy `http.Agent` implementation for HTTP and HTTPS
+ * [`socks-proxy-agent`][socks-proxy-agent]: A SOCKS (v4a) proxy `http.Agent` implementation for HTTP and HTTPS
+
+
+Installation
+------------
+
+Install with `npm`:
+
+``` bash
+$ npm install agent-base
+```
+
+
+Example
+-------
+
+Here's a minimal example that creates a new `net.Socket` connection to the server
+for every HTTP request (i.e. the equivalent of `agent: false` option):
+
+```js
+var net = require('net');
+var tls = require('tls');
+var url = require('url');
+var http = require('http');
+var agent = require('agent-base');
+
+var endpoint = 'http://nodejs.org/api/';
+var parsed = url.parse(endpoint);
+
+// This is the important part!
+parsed.agent = agent(function (req, opts) {
+  var socket;
+  // `secureEndpoint` is true when using the https module
+  if (opts.secureEndpoint) {
+    socket = tls.connect(opts);
+  } else {
+    socket = net.connect(opts);
+  }
+  return socket;
+});
+
+// Everything else works just like normal...
+http.get(parsed, function (res) {
+  console.log('"response" event!', res.headers);
+  res.pipe(process.stdout);
+});
+```
+
+Returning a Promise or using an `async` function is also supported:
+
+```js
+agent(async function (req, opts) {
+  await sleep(1000);
+  // etc…
+});
+```
+
+Return another `http.Agent` instance to "pass through" the responsibility
+for that HTTP request to that agent:
+
+```js
+agent(function (req, opts) {
+  return opts.secureEndpoint ? https.globalAgent : http.globalAgent;
+});
+```
+
+
+API
+---
+
+## Agent(Function callback[, Object options]) → [http.Agent][]
+
+Creates a base `http.Agent` that will execute the callback function `callback`
+for every HTTP request that it is used as the `agent` for. The callback function
+is responsible for creating a `stream.Duplex` instance of some kind that will be
+used as the underlying socket in the HTTP request.
+
+The `options` object accepts the following properties:
+
+  * `timeout` - Number - Timeout for the `callback()` function in milliseconds. Defaults to Infinity (optional).
+
+The callback function should have the following signature:
+
+### callback(http.ClientRequest req, Object options, Function cb) → undefined
+
+The ClientRequest `req` can be accessed to read request headers and
+and the path, etc. The `options` object contains the options passed
+to the `http.request()`/`https.request()` function call, and is formatted
+to be directly passed to `net.connect()`/`tls.connect()`, or however
+else you want a Socket to be created. Pass the created socket to
+the callback function `cb` once created, and the HTTP request will
+continue to proceed.
+
+If the `https` module is used to invoke the HTTP request, then the
+`secureEndpoint` property on `options` _will be set to `true`_.
+
+
+License
+-------
+
+(The MIT License)
+
+Copyright (c) 2013 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+[http-proxy-agent]: https://github.com/TooTallNate/node-http-proxy-agent
+[https-proxy-agent]: https://github.com/TooTallNate/node-https-proxy-agent
+[pac-proxy-agent]: https://github.com/TooTallNate/node-pac-proxy-agent
+[socks-proxy-agent]: https://github.com/TooTallNate/node-socks-proxy-agent
+[http.Agent]: https://nodejs.org/api/http.html#http_class_http_agent

express-server/node_modules/agent-base/index.js

@@ -0,0 +1,170 @@
+'use strict';
+require('./patch-core');
+const inherits = require('util').inherits;
+const promisify = require('es6-promisify');
+const EventEmitter = require('events').EventEmitter;
+
+module.exports = Agent;
+
+function isAgent(v) {
+  return v && typeof v.addRequest === 'function';
+}
+
+/**
+ * Base `http.Agent` implementation.
+ * No pooling/keep-alive is implemented by default.
+ *
+ * @param {Function} callback
+ * @api public
+ */
+function Agent(callback, _opts) {
+  if (!(this instanceof Agent)) {
+    return new Agent(callback, _opts);
+  }
+
+  EventEmitter.call(this);
+
+  // The callback gets promisified if it has 3 parameters
+  // (i.e. it has a callback function) lazily
+  this._promisifiedCallback = false;
+
+  let opts = _opts;
+  if ('function' === typeof callback) {
+    this.callback = callback;
+  } else if (callback) {
+    opts = callback;
+  }
+
+  // timeout for the socket to be returned from the callback
+  this.timeout = (opts && opts.timeout) || null;
+
+  this.options = opts;
+}
+inherits(Agent, EventEmitter);
+
+/**
+ * Override this function in your subclass!
+ */
+Agent.prototype.callback = function callback(req, opts) {
+  throw new Error(
+    '"agent-base" has no default implementation, you must subclass and override `callback()`'
+  );
+};
+
+/**
+ * Called by node-core's "_http_client.js" module when creating
+ * a new HTTP request with this Agent instance.
+ *
+ * @api public
+ */
+Agent.prototype.addRequest = function addRequest(req, _opts) {
+  const ownOpts = Object.assign({}, _opts);
+
+  // Set default `host` for HTTP to localhost
+  if (null == ownOpts.host) {
+    ownOpts.host = 'localhost';
+  }
+
+  // Set default `port` for HTTP if none was explicitly specified
+  if (null == ownOpts.port) {
+    ownOpts.port = ownOpts.secureEndpoint ? 443 : 80;
+  }
+
+  const opts = Object.assign({}, this.options, ownOpts);
+
+  if (opts.host && opts.path) {
+    // If both a `host` and `path` are specified then it's most likely the
+    // result of a `url.parse()` call... we need to remove the `path` portion so
+    // that `net.connect()` doesn't attempt to open that as a unix socket file.
+    delete opts.path;
+  }
+
+  delete opts.agent;
+  delete opts.hostname;
+  delete opts._defaultAgent;
+  delete opts.defaultPort;
+  delete opts.createConnection;
+
+  // Hint to use "Connection: close"
+  // XXX: non-documented `http` module API :(
+  req._last = true;
+  req.shouldKeepAlive = false;
+
+  // Create the `stream.Duplex` instance
+  let timeout;
+  let timedOut = false;
+  const timeoutMs = this.timeout;
+  const freeSocket = this.freeSocket;
+
+  function onerror(err) {
+    if (req._hadError) return;
+    req.emit('error', err);
+    // For Safety. Some additional errors might fire later on
+    // and we need to make sure we don't double-fire the error event.
+    req._hadError = true;
+  }
+
+  function ontimeout() {
+    timeout = null;
+    timedOut = true;
+    const err = new Error(
+      'A "socket" was not created for HTTP request before ' + timeoutMs + 'ms'
+    );
+    err.code = 'ETIMEOUT';
+    onerror(err);
+  }
+
+  function callbackError(err) {
+    if (timedOut) return;
+    if (timeout != null) {
+      clearTimeout(timeout);
+      timeout = null;
+    }
+    onerror(err);
+  }
+
+  function onsocket(socket) {
+    if (timedOut) return;
+    if (timeout != null) {
+      clearTimeout(timeout);
+      timeout = null;
+    }
+    if (isAgent(socket)) {
+      // `socket` is actually an http.Agent instance, so relinquish
+      // responsibility for this `req` to the Agent from here on
+      socket.addRequest(req, opts);
+    } else if (socket) {
+      function onfree() {
+        freeSocket(socket, opts);
+      }
+      socket.on('free', onfree);
+      req.onSocket(socket);
+    } else {
+      const err = new Error(
+        'no Duplex stream was returned to agent-base for `' + req.method + ' ' + req.path + '`'
+      );
+      onerror(err);
+    }
+  }
+
+  if (!this._promisifiedCallback && this.callback.length >= 3) {
+    // Legacy callback function - convert to a Promise
+    this.callback = promisify(this.callback, this);
+    this._promisifiedCallback = true;
+  }
+
+  if (timeoutMs > 0) {
+    timeout = setTimeout(ontimeout, timeoutMs);
+  }
+
+  try {
+    Promise.resolve(this.callback(req, opts)).then(onsocket, callbackError);
+  } catch (err) {
+    Promise.reject(err).catch(callbackError);
+  }
+};
+
+Agent.prototype.freeSocket = function freeSocket(socket, opts) {
+  // TODO reuse sockets
+  socket.destroy();
+};

express-server/node_modules/agent-base/package.json

@@ -0,0 +1,65 @@
+{
+  "_from": "agent-base@^4.1.0",
+  "_id": "agent-base@4.2.1",
+  "_inBundle": false,
+  "_integrity": "sha512-JVwXMr9nHYTUXsBFKUqhJwvlcYU/blreOEUkhNR2eXZIvwd+c+o5V4MgDPKWnMS/56awN3TRzIP+KoPn+roQtg==",
+  "_location": "/agent-base",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "range",
+    "registry": true,
+    "raw": "agent-base@^4.1.0",
+    "name": "agent-base",
+    "escapedName": "agent-base",
+    "rawSpec": "^4.1.0",
+    "saveSpec": null,
+    "fetchSpec": "^4.1.0"
+  },
+  "_requiredBy": [
+    "/https-proxy-agent"
+  ],
+  "_resolved": "https://registry.npmjs.org/agent-base/-/agent-base-4.2.1.tgz",
+  "_shasum": "d89e5999f797875674c07d87f260fc41e83e8ca9",
+  "_spec": "agent-base@^4.1.0",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\https-proxy-agent",
+  "author": {
+    "name": "Nathan Rajlich",
+    "email": "nathan@tootallnate.net",
+    "url": "http://n8.io/"
+  },
+  "bugs": {
+    "url": "https://github.com/TooTallNate/node-agent-base/issues"
+  },
+  "bundleDependencies": false,
+  "dependencies": {
+    "es6-promisify": "^5.0.0"
+  },
+  "deprecated": false,
+  "description": "Turn a function into an `http.Agent` instance",
+  "devDependencies": {
+    "mocha": "^3.4.2",
+    "ws": "^3.0.0"
+  },
+  "engines": {
+    "node": ">= 4.0.0"
+  },
+  "homepage": "https://github.com/TooTallNate/node-agent-base#readme",
+  "keywords": [
+    "http",
+    "agent",
+    "base",
+    "barebones",
+    "https"
+  ],
+  "license": "MIT",
+  "main": "./index.js",
+  "name": "agent-base",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/TooTallNate/node-agent-base.git"
+  },
+  "scripts": {
+    "test": "mocha --reporter spec"
+  },
+  "version": "4.2.1"
+}

express-server/node_modules/agent-base/patch-core.js

@@ -0,0 +1,37 @@
+'use strict';
+const url = require('url');
+const https = require('https');
+
+/**
+ * This currently needs to be applied to all Node.js versions
+ * in order to determine if the `req` is an HTTP or HTTPS request.
+ *
+ * There is currently no PR attempting to move this property upstream.
+ */
+https.request = (function(request) {
+  return function(_options, cb) {
+    let options;
+    if (typeof _options === 'string') {
+      options = url.parse(_options);
+    } else {
+      options = Object.assign({}, _options);
+    }
+    if (null == options.port) {
+      options.port = 443;
+    }
+    options.secureEndpoint = true;
+    return request.call(https, options, cb);
+  };
+})(https.request);
+
+/**
+ * This is needed for Node.js >= 9.0.0 to make sure `https.get()` uses the
+ * patched `https.request()`.
+ *
+ * Ref: https://github.com/nodejs/node/commit/5118f31
+ */
+https.get = function(options, cb) {
+  const req = https.request(options, cb);
+  req.end();
+  return req;
+};

express-server/node_modules/agent-base/test/ssl-cert-snakeoil.key

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQCzURxIqzer0ACAbX/lHdsn4Gd9PLKrf7EeDYfIdV0HZKPD8WDr
+bBx2/fBu0OW2sjnzv/SVZbJ0DAuPE/p0+eT0qb2qC10iz9iTD7ribd7gxhirVb8y
+b3fBjXsxc8V8p4Ny1LcvNSqCjwUbJqdRogfoJeTiqPM58z5sNzuv5iq7iwIDAQAB
+AoGAPMQy4olrP0UotlzlJ36bowLP70ffgHCwU+/f4NWs5fF78c3du0oSx1w820Dd
+Z7E0JF8bgnlJJTxjumPZz0RUCugrEHBKJmzEz3cxF5E3+7NvteZcjKn9D67RrM5x
+1/uSZ9cqKE9cYvY4fSuHx18diyZ4axR/wB1Pea2utjjDM+ECQQDb9ZbmmaWMiRpQ
+5Up+loxP7BZNPsEVsm+DVJmEFbaFgGfncWBqSIqnPNjMwTwj0OigTwCAEGPkfRVW
+T0pbYWCxAkEA0LK7SCTwzyDmhASUalk0x+3uCAA6ryFdwJf/wd8TRAvVOmkTEldX
+uJ7ldLvfrONYO3v56uKTU/SoNdZYzKtO+wJAX2KM4ctXYy5BXztPpr2acz4qHa1N
+Bh+vBAC34fOYhyQ76r3b1btHhWZ5jbFuZwm9F2erC94Ps5IaoqcX07DSwQJAPKGw
+h2U0EPkd/3zVIZCJJQya+vgWFIs9EZcXVtvYXQyTBkVApTN66MhBIYjzkub5205J
+bVQmOV37AKklY1DhwQJAA1wos0cYxro02edzatxd0DIR2r4qqOqLkw6BhYHhq6HJ
+ZvIcQkHqdSXzdETFc01I1znDGGIrJHcnvKWgBPoEUg==
+-----END RSA PRIVATE KEY-----

express-server/node_modules/agent-base/test/ssl-cert-snakeoil.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIB1TCCAT4CCQDV5mPlzm9+izANBgkqhkiG9w0BAQUFADAvMS0wKwYDVQQDEyQ3
+NTI3YmQ3Ny1hYjNlLTQ3NGItYWNlNy1lZWQ2MDUzOTMxZTcwHhcNMTUwNzA2MjI0
+NTA3WhcNMjUwNzAzMjI0NTA3WjAvMS0wKwYDVQQDEyQ3NTI3YmQ3Ny1hYjNlLTQ3
+NGItYWNlNy1lZWQ2MDUzOTMxZTcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGB
+ALNRHEirN6vQAIBtf+Ud2yfgZ308sqt/sR4Nh8h1XQdko8PxYOtsHHb98G7Q5bay
+OfO/9JVlsnQMC48T+nT55PSpvaoLXSLP2JMPuuJt3uDGGKtVvzJvd8GNezFzxXyn
+g3LUty81KoKPBRsmp1GiB+gl5OKo8znzPmw3O6/mKruLAgMBAAEwDQYJKoZIhvcN
+AQEFBQADgYEACzoHUF8UV2Z6541Q2wKEA0UFUzmUjf/E1XwBO+1P15ZZ64uw34B4
+1RwMPtAo9RY/PmICTWtNxWGxkzwb2JtDWtnxVER/lF8k2XcXPE76fxTHJF/BKk9J
+QU8OTD1dd9gHCBviQB9TqntRZ5X7axjtuWjb2umY+owBYzAHZkp1HKI=
+-----END CERTIFICATE-----

express-server/node_modules/agent-base/test/test.js

@@ -0,0 +1,697 @@
+/**
+ * Module dependencies.
+ */
+
+var fs = require('fs');
+var url = require('url');
+var net = require('net');
+var tls = require('tls');
+var http = require('http');
+var https = require('https');
+var WebSocket = require('ws');
+var assert = require('assert');
+var events = require('events');
+var inherits = require('util').inherits;
+var Agent = require('../');
+
+var PassthroughAgent = Agent(function(req, opts) {
+  return opts.secureEndpoint ? https.globalAgent : http.globalAgent;
+});
+
+describe('Agent', function() {
+  describe('subclass', function() {
+    it('should be subclassable', function(done) {
+      function MyAgent() {
+        Agent.call(this);
+      }
+      inherits(MyAgent, Agent);
+
+      MyAgent.prototype.callback = function(req, opts, fn) {
+        assert.equal(req.path, '/foo');
+        assert.equal(req.getHeader('host'), '127.0.0.1:1234');
+        assert.equal(opts.secureEndpoint, true);
+        done();
+      };
+
+      var info = url.parse('https://127.0.0.1:1234/foo');
+      info.agent = new MyAgent();
+      https.get(info);
+    });
+  });
+  describe('options', function() {
+    it('should support an options Object as first argument', function() {
+      var agent = new Agent({ timeout: 1000 });
+      assert.equal(1000, agent.timeout);
+    });
+    it('should support an options Object as second argument', function() {
+      var agent = new Agent(function() {}, { timeout: 1000 });
+      assert.equal(1000, agent.timeout);
+    });
+    it('should be mixed in with HTTP request options', function(done) {
+      var agent = new Agent({
+        host: 'my-proxy.com',
+        port: 3128,
+        foo: 'bar'
+      });
+      agent.callback = function(req, opts, fn) {
+        assert.equal('bar', opts.foo);
+        assert.equal('a', opts.b);
+
+        // `host` and `port` are special-cases, and should always be
+        // overwritten in the request `opts` inside the agent-base callback
+        assert.equal('localhost', opts.host);
+        assert.equal(80, opts.port);
+        done();
+      };
+      var opts = {
+        b: 'a',
+        agent: agent
+      };
+      http.get(opts);
+    });
+  });
+  describe('`this` context', function() {
+    it('should be the Agent instance', function(done) {
+      var called = false;
+      var agent = new Agent();
+      agent.callback = function() {
+        called = true;
+        assert.equal(this, agent);
+      };
+      var info = url.parse('http://127.0.0.1/foo');
+      info.agent = agent;
+      var req = http.get(info);
+      req.on('error', function(err) {
+        assert(/no Duplex stream was returned/.test(err.message));
+        done();
+      });
+    });
+    it('should be the Agent instance with callback signature', function(done) {
+      var called = false;
+      var agent = new Agent();
+      agent.callback = function(req, opts, fn) {
+        called = true;
+        assert.equal(this, agent);
+        fn();
+      };
+      var info = url.parse('http://127.0.0.1/foo');
+      info.agent = agent;
+      var req = http.get(info);
+      req.on('error', function(err) {
+        assert(/no Duplex stream was returned/.test(err.message));
+        done();
+      });
+    });
+  });
+  describe('"error" event', function() {
+    it('should be invoked on `http.ClientRequest` instance if `callback()` has not been defined', function(
+      done
+    ) {
+      var agent = new Agent();
+      var info = url.parse('http://127.0.0.1/foo');
+      info.agent = agent;
+      var req = http.get(info);
+      req.on('error', function(err) {
+        assert.equal(
+          '"agent-base" has no default implementation, you must subclass and override `callback()`',
+          err.message
+        );
+        done();
+      });
+    });
+    it('should be invoked on `http.ClientRequest` instance if Error passed to callback function on the first tick', function(
+      done
+    ) {
+      var agent = new Agent(function(req, opts, fn) {
+        fn(new Error('is this caught?'));
+      });
+      var info = url.parse('http://127.0.0.1/foo');
+      info.agent = agent;
+      var req = http.get(info);
+      req.on('error', function(err) {
+        assert.equal('is this caught?', err.message);
+        done();
+      });
+    });
+    it('should be invoked on `http.ClientRequest` instance if Error passed to callback function after the first tick', function(
+      done
+    ) {
+      var agent = new Agent(function(req, opts, fn) {
+        setTimeout(function() {
+          fn(new Error('is this caught?'));
+        }, 10);
+      });
+      var info = url.parse('http://127.0.0.1/foo');
+      info.agent = agent;
+      var req = http.get(info);
+      req.on('error', function(err) {
+        assert.equal('is this caught?', err.message);
+        done();
+      });
+    });
+  });
+  describe('artificial "streams"', function() {
+    it('should send a GET request', function(done) {
+      var stream = new events.EventEmitter();
+
+      // needed for the `http` module to call .write() on the stream
+      stream.writable = true;
+
+      stream.write = function(str) {
+        assert(0 == str.indexOf('GET / HTTP/1.1'));
+        done();
+      };
+
+      // needed for `http` module in Node.js 4
+      stream.cork = function() {};
+
+      var opts = {
+        method: 'GET',
+        host: '127.0.0.1',
+        path: '/',
+        port: 80,
+        agent: new Agent(function(req, opts, fn) {
+          fn(null, stream);
+        })
+      };
+      var req = http.request(opts);
+      req.end();
+    });
+    it('should receive a GET response', function(done) {
+      var stream = new events.EventEmitter();
+      var opts = {
+        method: 'GET',
+        host: '127.0.0.1',
+        path: '/',
+        port: 80,
+        agent: new Agent(function(req, opts, fn) {
+          fn(null, stream);
+        })
+      };
+      var req = http.request(opts, function(res) {
+        assert.equal('0.9', res.httpVersion);
+        assert.equal(111, res.statusCode);
+        assert.equal('bar', res.headers.foo);
+        done();
+      });
+
+      // have to wait for the "socket" event since `http.ClientRequest`
+      // doesn't *actually* attach the listeners to the "stream" until
+      // this happens
+      req.once('socket', function() {
+        var buf = new Buffer(
+          'HTTP/0.9 111\r\n' +
+            'Foo: bar\r\n' +
+            'Set-Cookie: 1\r\n' +
+            'Set-Cookie: 2\r\n\r\n'
+        );
+        stream.emit('data', buf);
+      });
+
+      req.end();
+    });
+  });
+});
+
+describe('"http" module', function() {
+  var server;
+  var port;
+
+  // setup test HTTP server
+  before(function(done) {
+    server = http.createServer();
+    server.listen(0, function() {
+      port = server.address().port;
+      done();
+    });
+  });
+
+  // shut down test HTTP server
+  after(function(done) {
+    server.once('close', function() {
+      done();
+    });
+    server.close();
+  });
+
+  it('should work for basic HTTP requests', function(done) {
+    var called = false;
+    var agent = new Agent(function(req, opts, fn) {
+      called = true;
+      var socket = net.connect(opts);
+      fn(null, socket);
+    });
+
+    // add HTTP server "request" listener
+    var gotReq = false;
+    server.once('request', function(req, res) {
+      gotReq = true;
+      res.setHeader('X-Foo', 'bar');
+      res.setHeader('X-Url', req.url);
+      res.end();
+    });
+
+    var info = url.parse('http://127.0.0.1:' + port + '/foo');
+    info.agent = agent;
+    http.get(info, function(res) {
+      assert.equal('bar', res.headers['x-foo']);
+      assert.equal('/foo', res.headers['x-url']);
+      assert(gotReq);
+      assert(called);
+      done();
+    });
+  });
+
+  it('should support direct return in `connect()`', function(done) {
+    var called = false;
+    var agent = new Agent(function(req, opts) {
+      called = true;
+      return net.connect(opts);
+    });
+
+    // add HTTP server "request" listener
+    var gotReq = false;
+    server.once('request', function(req, res) {
+      gotReq = true;
+      res.setHeader('X-Foo', 'bar');
+      res.setHeader('X-Url', req.url);
+      res.end();
+    });
+
+    var info = url.parse('http://127.0.0.1:' + port + '/foo');
+    info.agent = agent;
+    http.get(info, function(res) {
+      assert.equal('bar', res.headers['x-foo']);
+      assert.equal('/foo', res.headers['x-url']);
+      assert(gotReq);
+      assert(called);
+      done();
+    });
+  });
+
+  it('should support returning a Promise in `connect()`', function(done) {
+    var called = false;
+    var agent = new Agent(function(req, opts) {
+      return new Promise(function(resolve, reject) {
+        called = true;
+        resolve(net.connect(opts));
+      });
+    });
+
+    // add HTTP server "request" listener
+    var gotReq = false;
+    server.once('request', function(req, res) {
+      gotReq = true;
+      res.setHeader('X-Foo', 'bar');
+      res.setHeader('X-Url', req.url);
+      res.end();
+    });
+
+    var info = url.parse('http://127.0.0.1:' + port + '/foo');
+    info.agent = agent;
+    http.get(info, function(res) {
+      assert.equal('bar', res.headers['x-foo']);
+      assert.equal('/foo', res.headers['x-url']);
+      assert(gotReq);
+      assert(called);
+      done();
+    });
+  });
+
+  it('should set the `Connection: close` response header', function(done) {
+    var called = false;
+    var agent = new Agent(function(req, opts, fn) {
+      called = true;
+      var socket = net.connect(opts);
+      fn(null, socket);
+    });
+
+    // add HTTP server "request" listener
+    var gotReq = false;
+    server.once('request', function(req, res) {
+      gotReq = true;
+      res.setHeader('X-Url', req.url);
+      assert.equal('close', req.headers.connection);
+      res.end();
+    });
+
+    var info = url.parse('http://127.0.0.1:' + port + '/bar');
+    info.agent = agent;
+    http.get(info, function(res) {
+      assert.equal('/bar', res.headers['x-url']);
+      assert.equal('close', res.headers.connection);
+      assert(gotReq);
+      assert(called);
+      done();
+    });
+  });
+
+  it('should pass through options from `http.request()`', function(done) {
+    var agent = new Agent(function(req, opts, fn) {
+      assert.equal('google.com', opts.host);
+      assert.equal('bar', opts.foo);
+      done();
+    });
+
+    http.get({
+      host: 'google.com',
+      foo: 'bar',
+      agent: agent
+    });
+  });
+
+  it('should default to port 80', function(done) {
+    var agent = new Agent(function(req, opts, fn) {
+      assert.equal(80, opts.port);
+      done();
+    });
+
+    // (probably) not hitting a real HTTP server here,
+    // so no need to add a httpServer request listener
+    http.get({
+      host: '127.0.0.1',
+      path: '/foo',
+      agent: agent
+    });
+  });
+
+  it('should support the "timeout" option', function(done) {
+    // ensure we timeout after the "error" event had a chance to trigger
+    this.timeout(1000);
+    this.slow(800);
+
+    var agent = new Agent(
+      function(req, opts, fn) {
+        // this function will time out
+      },
+      { timeout: 100 }
+    );
+
+    var opts = url.parse('http://nodejs.org');
+    opts.agent = agent;
+
+    var req = http.get(opts);
+    req.once('error', function(err) {
+      assert.equal('ETIMEOUT', err.code);
+      req.abort();
+      done();
+    });
+  });
+
+  it('should free sockets after use', function(done) {
+    var agent = new Agent(function(req, opts, fn) {
+      var socket = net.connect(opts);
+      fn(null, socket);
+    });
+
+    // add HTTP server "request" listener
+    var gotReq = false;
+    server.once('request', function(req, res) {
+      gotReq = true;
+      res.end();
+    });
+
+    var info = url.parse('http://127.0.0.1:' + port + '/foo');
+    info.agent = agent;
+    http.get(info, function(res) {
+      res.socket.emit('free');
+      assert.equal(true, res.socket.destroyed);
+      assert(gotReq);
+      done();
+    });
+  });
+
+
+  describe('PassthroughAgent', function() {
+    it('should pass through to `http.globalAgent`', function(done) {
+      // add HTTP server "request" listener
+      var gotReq = false;
+      server.once('request', function(req, res) {
+        gotReq = true;
+        res.setHeader('X-Foo', 'bar');
+        res.setHeader('X-Url', req.url);
+        res.end();
+      });
+
+      var info = url.parse('http://127.0.0.1:' + port + '/foo');
+      info.agent = PassthroughAgent;
+      http.get(info, function(res) {
+        assert.equal('bar', res.headers['x-foo']);
+        assert.equal('/foo', res.headers['x-url']);
+        assert(gotReq);
+        done();
+      });
+    });
+  });
+});
+
+describe('"https" module', function() {
+  var server;
+  var port;
+
+  // setup test HTTPS server
+  before(function(done) {
+    var options = {
+      key: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.key'),
+      cert: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.pem')
+    };
+    server = https.createServer(options);
+    server.listen(0, function() {
+      port = server.address().port;
+      done();
+    });
+  });
+
+  // shut down test HTTP server
+  after(function(done) {
+    server.once('close', function() {
+      done();
+    });
+    server.close();
+  });
+
+  it('should not modify the passed in Options object', function(done) {
+    var called = false;
+    var agent = new Agent(function(req, opts, fn) {
+      called = true;
+      assert.equal(true, opts.secureEndpoint);
+      assert.equal(443, opts.port);
+      assert.equal('localhost', opts.host);
+    });
+    var opts = { agent: agent };
+    var req = https.request(opts);
+    assert.equal(true, called);
+    assert.equal(false, 'secureEndpoint' in opts);
+    assert.equal(false, 'port' in opts);
+    done();
+  });
+
+  it('should work with a String URL', function(done) {
+    var endpoint = 'https://127.0.0.1:' + port;
+    var req = https.get(endpoint);
+
+    // it's gonna error out since `rejectUnauthorized` is not being passed in
+    req.on('error', function(err) {
+      assert.equal(err.code, 'DEPTH_ZERO_SELF_SIGNED_CERT');
+      done();
+    });
+  });
+
+  it('should work for basic HTTPS requests', function(done) {
+    var called = false;
+    var agent = new Agent(function(req, opts, fn) {
+      called = true;
+      assert(opts.secureEndpoint);
+      var socket = tls.connect(opts);
+      fn(null, socket);
+    });
+
+    // add HTTPS server "request" listener
+    var gotReq = false;
+    server.once('request', function(req, res) {
+      gotReq = true;
+      res.setHeader('X-Foo', 'bar');
+      res.setHeader('X-Url', req.url);
+      res.end();
+    });
+
+    var info = url.parse('https://127.0.0.1:' + port + '/foo');
+    info.agent = agent;
+    info.rejectUnauthorized = false;
+    https.get(info, function(res) {
+      assert.equal('bar', res.headers['x-foo']);
+      assert.equal('/foo', res.headers['x-url']);
+      assert(gotReq);
+      assert(called);
+      done();
+    });
+  });
+
+  it('should pass through options from `https.request()`', function(done) {
+    var agent = new Agent(function(req, opts, fn) {
+      assert.equal('google.com', opts.host);
+      assert.equal('bar', opts.foo);
+      done();
+    });
+
+    https.get({
+      host: 'google.com',
+      foo: 'bar',
+      agent: agent
+    });
+  });
+
+  it('should default to port 443', function(done) {
+    var agent = new Agent(function(req, opts, fn) {
+      assert.equal(true, opts.secureEndpoint);
+      assert.equal(false, opts.rejectUnauthorized);
+      assert.equal(443, opts.port);
+      done();
+    });
+
+    // (probably) not hitting a real HTTPS server here,
+    // so no need to add a httpsServer request listener
+    https.get({
+      host: '127.0.0.1',
+      path: '/foo',
+      agent: agent,
+      rejectUnauthorized: false
+    });
+  });
+
+  describe('PassthroughAgent', function() {
+    it('should pass through to `https.globalAgent`', function(done) {
+      // add HTTP server "request" listener
+      var gotReq = false;
+      server.once('request', function(req, res) {
+        gotReq = true;
+        res.setHeader('X-Foo', 'bar');
+        res.setHeader('X-Url', req.url);
+        res.end();
+      });
+
+      var info = url.parse('https://127.0.0.1:' + port + '/foo');
+      info.agent = PassthroughAgent;
+      info.rejectUnauthorized = false;
+      https.get(info, function(res) {
+        assert.equal('bar', res.headers['x-foo']);
+        assert.equal('/foo', res.headers['x-url']);
+        assert(gotReq);
+        done();
+      });
+    });
+  });
+});
+
+describe('"ws" server', function() {
+  var wss;
+  var server;
+  var port;
+
+  // setup test HTTP server
+  before(function(done) {
+    server = http.createServer();
+    wss = new WebSocket.Server({ server: server });
+    server.listen(0, function() {
+      port = server.address().port;
+      done();
+    });
+  });
+
+  // shut down test HTTP server
+  after(function(done) {
+    server.once('close', function() {
+      done();
+    });
+    server.close();
+  });
+
+  it('should work for basic WebSocket connections', function(done) {
+    function onconnection(ws) {
+      ws.on('message', function(data) {
+        assert.equal('ping', data);
+        ws.send('pong');
+      });
+    }
+    wss.on('connection', onconnection);
+
+    var agent = new Agent(function(req, opts, fn) {
+      var socket = net.connect(opts);
+      fn(null, socket);
+    });
+
+    var client = new WebSocket('ws://127.0.0.1:' + port + '/', {
+      agent: agent
+    });
+
+    client.on('open', function() {
+      client.send('ping');
+    });
+
+    client.on('message', function(data) {
+      assert.equal('pong', data);
+      client.close();
+      wss.removeListener('connection', onconnection);
+      done();
+    });
+  });
+});
+
+describe('"wss" server', function() {
+  var wss;
+  var server;
+  var port;
+
+  // setup test HTTP server
+  before(function(done) {
+    var options = {
+      key: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.key'),
+      cert: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.pem')
+    };
+    server = https.createServer(options);
+    wss = new WebSocket.Server({ server: server });
+    server.listen(0, function() {
+      port = server.address().port;
+      done();
+    });
+  });
+
+  // shut down test HTTP server
+  after(function(done) {
+    server.once('close', function() {
+      done();
+    });
+    server.close();
+  });
+
+  it('should work for secure WebSocket connections', function(done) {
+    function onconnection(ws) {
+      ws.on('message', function(data) {
+        assert.equal('ping', data);
+        ws.send('pong');
+      });
+    }
+    wss.on('connection', onconnection);
+
+    var agent = new Agent(function(req, opts, fn) {
+      var socket = tls.connect(opts);
+      fn(null, socket);
+    });
+
+    var client = new WebSocket('wss://127.0.0.1:' + port + '/', {
+      agent: agent,
+      rejectUnauthorized: false
+    });
+
+    client.on('open', function() {
+      client.send('ping');
+    });
+
+    client.on('message', function(data) {
+      assert.equal('pong', data);
+      client.close();
+      wss.removeListener('connection', onconnection);
+      done();
+    });
+  });
+});

express-server/node_modules/axios/CHANGELOG.md

@@ -0,0 +1,245 @@
+# Changelog
+
+### 0.18.0 (Feb 19, 2018)
+
+- Adding support for UNIX Sockets when running with Node.js ([#1070](https://github.com/axios/axios/pull/1070))
+- Fixing typings ([#1177](https://github.com/axios/axios/pull/1177)):
+    - AxiosRequestConfig.proxy: allows type false
+    - AxiosProxyConfig: added auth field
+- Adding function signature in AxiosInstance interface so AxiosInstance can be invoked ([#1192](https://github.com/axios/axios/pull/1192), [#1254](https://github.com/axios/axios/pull/1254))
+- Allowing maxContentLength to pass through to redirected calls as maxBodyLength in follow-redirects config ([#1287](https://github.com/axios/axios/pull/1287))
+- Fixing configuration when using an instance - method can now be set ([#1342](https://github.com/axios/axios/pull/1342))
+
+
+### 0.17.1 (Nov 11, 2017)
+
+- Fixing issue with web workers ([#1160](https://github.com/axios/axios/pull/1160))
+- Allowing overriding transport ([#1080](https://github.com/axios/axios/pull/1080))
+- Updating TypeScript typings ([#1165](https://github.com/axios/axios/pull/1165), [#1125](https://github.com/axios/axios/pull/1125), [#1131](https://github.com/axios/axios/pull/1131))
+
+### 0.17.0 (Oct 21, 2017)
+
+- **BREAKING** Fixing issue with `baseURL` and interceptors ([#950](https://github.com/axios/axios/pull/950))
+- **BREAKING** Improving handing of duplicate headers ([#874](https://github.com/axios/axios/pull/874))
+- Adding support for disabling proxies ([#691](https://github.com/axios/axios/pull/691))
+- Updating TypeScript typings with generic type parameters ([#1061](https://github.com/axios/axios/pull/1061))
+
+### 0.16.2 (Jun 3, 2017)
+
+- Fixing issue with including `buffer` in bundle ([#887](https://github.com/axios/axios/pull/887))
+- Including underlying request in errors ([#830](https://github.com/axios/axios/pull/830))
+- Convert `method` to lowercase ([#930](https://github.com/axios/axios/pull/930))
+
+### 0.16.1 (Apr 8, 2017)
+
+- Improving HTTP adapter to return last request in case of redirects ([#828](https://github.com/axios/axios/pull/828))
+- Updating `follow-redirects` dependency ([#829](https://github.com/axios/axios/pull/829))
+- Adding support for passing `Buffer` in node ([#773](https://github.com/axios/axios/pull/773))
+
+### 0.16.0 (Mar 31, 2017)
+
+- **BREAKING** Removing `Promise` from axios typings in favor of built-in type declarations ([#480](https://github.com/axios/axios/issues/480))
+- Adding `options` shortcut method ([#461](https://github.com/axios/axios/pull/461))
+- Fixing issue with using `responseType: 'json'` in browsers incompatible with XHR Level 2 ([#654](https://github.com/axios/axios/pull/654))
+- Improving React Native detection ([#731](https://github.com/axios/axios/pull/731))
+- Fixing `combineURLs` to support empty `relativeURL` ([#581](https://github.com/axios/axios/pull/581))
+- Removing `PROTECTION_PREFIX` support ([#561](https://github.com/axios/axios/pull/561))
+
+### 0.15.3 (Nov 27, 2016)
+
+- Fixing issue with custom instances and global defaults ([#443](https://github.com/axios/axios/issues/443))
+- Renaming `axios.d.ts` to `index.d.ts` ([#519](https://github.com/axios/axios/issues/519))
+- Adding `get`, `head`, and `delete` to `defaults.headers` ([#509](https://github.com/axios/axios/issues/509))
+- Fixing issue with `btoa` and IE ([#507](https://github.com/axios/axios/issues/507))
+- Adding support for proxy authentication ([#483](https://github.com/axios/axios/pull/483))
+- Improving HTTP adapter to use `http` protocol by default ([#493](https://github.com/axios/axios/pull/493))
+- Fixing proxy issues ([#491](https://github.com/axios/axios/pull/491))
+
+### 0.15.2 (Oct 17, 2016)
+
+- Fixing issue with calling `cancel` after response has been received ([#482](https://github.com/axios/axios/issues/482))
+
+### 0.15.1 (Oct 14, 2016)
+
+- Fixing issue with UMD ([#485](https://github.com/axios/axios/issues/485))
+
+### 0.15.0 (Oct 10, 2016)
+
+- Adding cancellation support ([#452](https://github.com/axios/axios/pull/452))
+- Moving default adapter to global defaults ([#437](https://github.com/axios/axios/pull/437))
+- Fixing issue with `file` URI scheme ([#440](https://github.com/axios/axios/pull/440))
+- Fixing issue with `params` objects that have no prototype ([#445](https://github.com/axios/axios/pull/445))
+
+### 0.14.0 (Aug 27, 2016)
+
+- **BREAKING** Updating TypeScript definitions ([#419](https://github.com/axios/axios/pull/419))
+- **BREAKING** Replacing `agent` option with `httpAgent` and `httpsAgent` ([#387](https://github.com/axios/axios/pull/387))
+- **BREAKING** Splitting `progress` event handlers into `onUploadProgress` and `onDownloadProgress` ([#423](https://github.com/axios/axios/pull/423))
+- Adding support for `http_proxy` and `https_proxy` environment variables ([#366](https://github.com/axios/axios/pull/366))
+- Fixing issue with `auth` config option and `Authorization` header ([#397](https://github.com/axios/axios/pull/397))
+- Don't set XSRF header if `xsrfCookieName` is `null` ([#406](https://github.com/axios/axios/pull/406))
+
+### 0.13.1 (Jul 16, 2016)
+
+- Fixing issue with response data not being transformed on error ([#378](https://github.com/axios/axios/issues/378))
+
+### 0.13.0 (Jul 13, 2016)
+
+- **BREAKING** Improved error handling ([#345](https://github.com/axios/axios/pull/345))
+- **BREAKING** Response transformer now invoked in dispatcher not adapter ([10eb238](https://github.com/axios/axios/commit/10eb23865101f9347570552c04e9d6211376e25e))
+- **BREAKING** Request adapters now return a `Promise` ([157efd5](https://github.com/axios/axios/commit/157efd5615890301824e3121cc6c9d2f9b21f94a))
+- Fixing issue with `withCredentials` not being overwritten ([#343](https://github.com/axios/axios/issues/343))
+- Fixing regression with request transformer being called before request interceptor ([#352](https://github.com/axios/axios/issues/352))
+- Fixing custom instance defaults ([#341](https://github.com/axios/axios/issues/341))
+- Fixing instances created from `axios.create` to have same API as default axios ([#217](https://github.com/axios/axios/issues/217))
+
+### 0.12.0 (May 31, 2016)
+
+- Adding support for `URLSearchParams` ([#317](https://github.com/axios/axios/pull/317))
+- Adding `maxRedirects` option ([#307](https://github.com/axios/axios/pull/307))
+
+### 0.11.1 (May 17, 2016)
+
+- Fixing IE CORS support ([#313](https://github.com/axios/axios/pull/313))
+- Fixing detection of `FormData` ([#325](https://github.com/axios/axios/pull/325))
+- Adding `Axios` class to exports ([#321](https://github.com/axios/axios/pull/321))
+
+### 0.11.0 (Apr 26, 2016)
+
+- Adding support for Stream with HTTP adapter ([#296](https://github.com/axios/axios/pull/296))
+- Adding support for custom HTTP status code error ranges ([#308](https://github.com/axios/axios/pull/308))
+- Fixing issue with ArrayBuffer ([#299](https://github.com/axios/axios/pull/299))
+
+### 0.10.0 (Apr 20, 2016)
+
+- Fixing issue with some requests sending `undefined` instead of `null` ([#250](https://github.com/axios/axios/pull/250))
+- Fixing basic auth for HTTP adapter ([#252](https://github.com/axios/axios/pull/252))
+- Fixing request timeout for XHR adapter ([#227](https://github.com/axios/axios/pull/227))
+- Fixing IE8 support by using `onreadystatechange` instead of `onload` ([#249](https://github.com/axios/axios/pull/249))
+- Fixing IE9 cross domain requests ([#251](https://github.com/axios/axios/pull/251))
+- Adding `maxContentLength` option ([#275](https://github.com/axios/axios/pull/275))
+- Fixing XHR support for WebWorker environment ([#279](https://github.com/axios/axios/pull/279))
+- Adding request instance to response ([#200](https://github.com/axios/axios/pull/200))
+
+### 0.9.1 (Jan 24, 2016)
+
+- Improving handling of request timeout in node ([#124](https://github.com/axios/axios/issues/124))
+- Fixing network errors not rejecting ([#205](https://github.com/axios/axios/pull/205))
+- Fixing issue with IE rejecting on HTTP 204 ([#201](https://github.com/axios/axios/issues/201))
+- Fixing host/port when following redirects ([#198](https://github.com/axios/axios/pull/198))
+
+### 0.9.0 (Jan 18, 2016)
+
+- Adding support for custom adapters
+- Fixing Content-Type header being removed when data is false ([#195](https://github.com/axios/axios/pull/195))
+- Improving XDomainRequest implementation ([#185](https://github.com/axios/axios/pull/185))
+- Improving config merging and order of precedence ([#183](https://github.com/axios/axios/pull/183))
+- Fixing XDomainRequest support for only <= IE9 ([#182](https://github.com/axios/axios/pull/182))
+
+### 0.8.1 (Dec 14, 2015)
+
+- Adding support for passing XSRF token for cross domain requests when using `withCredentials` ([#168](https://github.com/axios/axios/pull/168))
+- Fixing error with format of basic auth header ([#178](https://github.com/axios/axios/pull/173))
+- Fixing error with JSON payloads throwing `InvalidStateError` in some cases ([#174](https://github.com/axios/axios/pull/174))
+
+### 0.8.0 (Dec 11, 2015)
+
+- Adding support for creating instances of axios ([#123](https://github.com/axios/axios/pull/123))
+- Fixing http adapter to use `Buffer` instead of `String` in case of `responseType === 'arraybuffer'` ([#128](https://github.com/axios/axios/pull/128))
+- Adding support for using custom parameter serializer with `paramsSerializer` option ([#121](https://github.com/axios/axios/pull/121))
+- Fixing issue in IE8 caused by `forEach` on `arguments` ([#127](https://github.com/axios/axios/pull/127))
+- Adding support for following redirects in node ([#146](https://github.com/axios/axios/pull/146))
+- Adding support for transparent decompression if `content-encoding` is set ([#149](https://github.com/axios/axios/pull/149))
+- Adding support for transparent XDomainRequest to handle cross domain requests in IE9 ([#140](https://github.com/axios/axios/pull/140))
+- Adding support for HTTP basic auth via Authorization header ([#167](https://github.com/axios/axios/pull/167))
+- Adding support for baseURL option ([#160](https://github.com/axios/axios/pull/160))
+
+### 0.7.0 (Sep 29, 2015)
+
+- Fixing issue with minified bundle in IE8 ([#87](https://github.com/axios/axios/pull/87))
+- Adding support for passing agent in node ([#102](https://github.com/axios/axios/pull/102))
+- Adding support for returning result from `axios.spread` for chaining ([#106](https://github.com/axios/axios/pull/106))
+- Fixing typescript definition ([#105](https://github.com/axios/axios/pull/105))
+- Fixing default timeout config for node ([#112](https://github.com/axios/axios/pull/112))
+- Adding support for use in web workers, and react-native ([#70](https://github.com/axios/axios/issue/70)), ([#98](https://github.com/axios/axios/pull/98))
+- Adding support for fetch like API `axios(url[, config])` ([#116](https://github.com/axios/axios/issues/116))
+
+### 0.6.0 (Sep 21, 2015)
+
+- Removing deprecated success/error aliases
+- Fixing issue with array params not being properly encoded ([#49](https://github.com/axios/axios/pull/49))
+- Fixing issue with User-Agent getting overridden ([#69](https://github.com/axios/axios/issues/69))
+- Adding support for timeout config ([#56](https://github.com/axios/axios/issues/56))
+- Removing es6-promise dependency
+- Fixing issue preventing `length` to be used as a parameter ([#91](https://github.com/axios/axios/pull/91))
+- Fixing issue with IE8 ([#85](https://github.com/axios/axios/pull/85))
+- Converting build to UMD
+
+### 0.5.4 (Apr 08, 2015)
+
+- Fixing issue with FormData not being sent ([#53](https://github.com/axios/axios/issues/53))
+
+### 0.5.3 (Apr 07, 2015)
+
+- Using JSON.parse unconditionally when transforming response string ([#55](https://github.com/axios/axios/issues/55))
+
+### 0.5.2 (Mar 13, 2015)
+
+- Adding support for `statusText` in response ([#46](https://github.com/axios/axios/issues/46))
+
+### 0.5.1 (Mar 10, 2015)
+
+- Fixing issue using strict mode ([#45](https://github.com/axios/axios/issues/45))
+- Fixing issue with standalone build ([#47](https://github.com/axios/axios/issues/47))
+
+### 0.5.0 (Jan 23, 2015)
+
+- Adding support for intercepetors ([#14](https://github.com/axios/axios/issues/14))
+- Updating es6-promise dependency
+
+### 0.4.2 (Dec 10, 2014)
+
+- Fixing issue with `Content-Type` when using `FormData` ([#22](https://github.com/axios/axios/issues/22))
+- Adding support for TypeScript ([#25](https://github.com/axios/axios/issues/25))
+- Fixing issue with standalone build ([#29](https://github.com/axios/axios/issues/29))
+- Fixing issue with verbs needing to be capitalized in some browsers ([#30](https://github.com/axios/axios/issues/30))
+
+### 0.4.1 (Oct 15, 2014)
+
+- Adding error handling to request for node.js ([#18](https://github.com/axios/axios/issues/18))
+
+### 0.4.0 (Oct 03, 2014)
+
+- Adding support for `ArrayBuffer` and `ArrayBufferView` ([#10](https://github.com/axios/axios/issues/10))
+- Adding support for utf-8 for node.js ([#13](https://github.com/axios/axios/issues/13))
+- Adding support for SSL for node.js ([#12](https://github.com/axios/axios/issues/12))
+- Fixing incorrect `Content-Type` header ([#9](https://github.com/axios/axios/issues/9))
+- Adding standalone build without bundled es6-promise ([#11](https://github.com/axios/axios/issues/11))
+- Deprecating `success`/`error` in favor of `then`/`catch`
+
+### 0.3.1 (Sep 16, 2014)
+
+- Fixing missing post body when using node.js ([#3](https://github.com/axios/axios/issues/3))
+
+### 0.3.0 (Sep 16, 2014)
+
+- Fixing `success` and `error` to properly receive response data as individual arguments ([#8](https://github.com/axios/axios/issues/8))
+- Updating `then` and `catch` to receive response data as a single object ([#6](https://github.com/axios/axios/issues/6))
+- Fixing issue with `all` not working ([#7](https://github.com/axios/axios/issues/7))
+
+### 0.2.2 (Sep 14, 2014)
+
+- Fixing bundling with browserify ([#4](https://github.com/axios/axios/issues/4))
+
+### 0.2.1 (Sep 12, 2014)
+
+- Fixing build problem causing ridiculous file sizes
+
+### 0.2.0 (Sep 12, 2014)
+
+- Adding support for `all` and `spread`
+- Adding support for node.js ([#1](https://github.com/axios/axios/issues/1))
+
+### 0.1.0 (Aug 29, 2014)
+
+- Initial release

express-server/node_modules/axios/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2014-present Matt Zabriskie
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

express-server/node_modules/axios/README.md

@@ -0,0 +1,625 @@
+# axios
+
+[![npm version](https://img.shields.io/npm/v/axios.svg?style=flat-square)](https://www.npmjs.org/package/axios)
+[![build status](https://img.shields.io/travis/axios/axios.svg?style=flat-square)](https://travis-ci.org/axios/axios)
+[![code coverage](https://img.shields.io/coveralls/mzabriskie/axios.svg?style=flat-square)](https://coveralls.io/r/mzabriskie/axios)
+[![npm downloads](https://img.shields.io/npm/dm/axios.svg?style=flat-square)](http://npm-stat.com/charts.html?package=axios)
+[![gitter chat](https://img.shields.io/gitter/room/mzabriskie/axios.svg?style=flat-square)](https://gitter.im/mzabriskie/axios)
+[![code helpers](https://www.codetriage.com/axios/axios/badges/users.svg)](https://www.codetriage.com/axios/axios)
+
+Promise based HTTP client for the browser and node.js
+
+## Features
+
+- Make [XMLHttpRequests](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest) from the browser
+- Make [http](http://nodejs.org/api/http.html) requests from node.js
+- Supports the [Promise](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) API
+- Intercept request and response
+- Transform request and response data
+- Cancel requests
+- Automatic transforms for JSON data
+- Client side support for protecting against [XSRF](http://en.wikipedia.org/wiki/Cross-site_request_forgery)
+
+## Browser Support
+
+![Chrome](https://raw.github.com/alrra/browser-logos/master/src/chrome/chrome_48x48.png) | ![Firefox](https://raw.github.com/alrra/browser-logos/master/src/firefox/firefox_48x48.png) | ![Safari](https://raw.github.com/alrra/browser-logos/master/src/safari/safari_48x48.png) | ![Opera](https://raw.github.com/alrra/browser-logos/master/src/opera/opera_48x48.png) | ![Edge](https://raw.github.com/alrra/browser-logos/master/src/edge/edge_48x48.png) | ![IE](https://raw.github.com/alrra/browser-logos/master/src/archive/internet-explorer_9-11/internet-explorer_9-11_48x48.png) |
+--- | --- | --- | --- | --- | --- |
+Latest ✔ | Latest ✔ | Latest ✔ | Latest ✔ | Latest ✔ | 8+ ✔ |
+
+[![Browser Matrix](https://saucelabs.com/open_sauce/build_matrix/axios.svg)](https://saucelabs.com/u/axios)
+
+## Installing
+
+Using npm:
+
+```bash
+$ npm install axios
+```
+
+Using bower:
+
+```bash
+$ bower install axios
+```
+
+Using cdn:
+
+```html
+<script src="https://unpkg.com/axios/dist/axios.min.js"></script>
+```
+
+## Example
+
+Performing a `GET` request
+
+```js
+// Make a request for a user with a given ID
+axios.get('/user?ID=12345')
+  .then(function (response) {
+    console.log(response);
+  })
+  .catch(function (error) {
+    console.log(error);
+  });
+
+// Optionally the request above could also be done as
+axios.get('/user', {
+    params: {
+      ID: 12345
+    }
+  })
+  .then(function (response) {
+    console.log(response);
+  })
+  .catch(function (error) {
+    console.log(error);
+  });
+```
+
+Performing a `POST` request
+
+```js
+axios.post('/user', {
+    firstName: 'Fred',
+    lastName: 'Flintstone'
+  })
+  .then(function (response) {
+    console.log(response);
+  })
+  .catch(function (error) {
+    console.log(error);
+  });
+```
+
+Performing multiple concurrent requests
+
+```js
+function getUserAccount() {
+  return axios.get('/user/12345');
+}
+
+function getUserPermissions() {
+  return axios.get('/user/12345/permissions');
+}
+
+axios.all([getUserAccount(), getUserPermissions()])
+  .then(axios.spread(function (acct, perms) {
+    // Both requests are now complete
+  }));
+```
+
+## axios API
+
+Requests can be made by passing the relevant config to `axios`.
+
+##### axios(config)
+
+```js
+// Send a POST request
+axios({
+  method: 'post',
+  url: '/user/12345',
+  data: {
+    firstName: 'Fred',
+    lastName: 'Flintstone'
+  }
+});
+```
+
+```js
+// GET request for remote image
+axios({
+  method:'get',
+  url:'http://bit.ly/2mTM3nY',
+  responseType:'stream'
+})
+  .then(function(response) {
+  response.data.pipe(fs.createWriteStream('ada_lovelace.jpg'))
+});
+```
+
+##### axios(url[, config])
+
+```js
+// Send a GET request (default method)
+axios('/user/12345');
+```
+
+### Request method aliases
+
+For convenience aliases have been provided for all supported request methods.
+
+##### axios.request(config)
+##### axios.get(url[, config])
+##### axios.delete(url[, config])
+##### axios.head(url[, config])
+##### axios.options(url[, config])
+##### axios.post(url[, data[, config]])
+##### axios.put(url[, data[, config]])
+##### axios.patch(url[, data[, config]])
+
+###### NOTE
+When using the alias methods `url`, `method`, and `data` properties don't need to be specified in config.
+
+### Concurrency
+
+Helper functions for dealing with concurrent requests.
+
+##### axios.all(iterable)
+##### axios.spread(callback)
+
+### Creating an instance
+
+You can create a new instance of axios with a custom config.
+
+##### axios.create([config])
+
+```js
+var instance = axios.create({
+  baseURL: 'https://some-domain.com/api/',
+  timeout: 1000,
+  headers: {'X-Custom-Header': 'foobar'}
+});
+```
+
+### Instance methods
+
+The available instance methods are listed below. The specified config will be merged with the instance config.
+
+##### axios#request(config)
+##### axios#get(url[, config])
+##### axios#delete(url[, config])
+##### axios#head(url[, config])
+##### axios#options(url[, config])
+##### axios#post(url[, data[, config]])
+##### axios#put(url[, data[, config]])
+##### axios#patch(url[, data[, config]])
+
+## Request Config
+
+These are the available config options for making requests. Only the `url` is required. Requests will default to `GET` if `method` is not specified.
+
+```js
+{
+  // `url` is the server URL that will be used for the request
+  url: '/user',
+
+  // `method` is the request method to be used when making the request
+  method: 'get', // default
+
+  // `baseURL` will be prepended to `url` unless `url` is absolute.
+  // It can be convenient to set `baseURL` for an instance of axios to pass relative URLs
+  // to methods of that instance.
+  baseURL: 'https://some-domain.com/api/',
+
+  // `transformRequest` allows changes to the request data before it is sent to the server
+  // This is only applicable for request methods 'PUT', 'POST', and 'PATCH'
+  // The last function in the array must return a string or an instance of Buffer, ArrayBuffer,
+  // FormData or Stream
+  // You may modify the headers object.
+  transformRequest: [function (data, headers) {
+    // Do whatever you want to transform the data
+
+    return data;
+  }],
+
+  // `transformResponse` allows changes to the response data to be made before
+  // it is passed to then/catch
+  transformResponse: [function (data) {
+    // Do whatever you want to transform the data
+
+    return data;
+  }],
+
+  // `headers` are custom headers to be sent
+  headers: {'X-Requested-With': 'XMLHttpRequest'},
+
+  // `params` are the URL parameters to be sent with the request
+  // Must be a plain object or a URLSearchParams object
+  params: {
+    ID: 12345
+  },
+
+  // `paramsSerializer` is an optional function in charge of serializing `params`
+  // (e.g. https://www.npmjs.com/package/qs, http://api.jquery.com/jquery.param/)
+  paramsSerializer: function(params) {
+    return Qs.stringify(params, {arrayFormat: 'brackets'})
+  },
+
+  // `data` is the data to be sent as the request body
+  // Only applicable for request methods 'PUT', 'POST', and 'PATCH'
+  // When no `transformRequest` is set, must be of one of the following types:
+  // - string, plain object, ArrayBuffer, ArrayBufferView, URLSearchParams
+  // - Browser only: FormData, File, Blob
+  // - Node only: Stream, Buffer
+  data: {
+    firstName: 'Fred'
+  },
+
+  // `timeout` specifies the number of milliseconds before the request times out.
+  // If the request takes longer than `timeout`, the request will be aborted.
+  timeout: 1000,
+
+  // `withCredentials` indicates whether or not cross-site Access-Control requests
+  // should be made using credentials
+  withCredentials: false, // default
+
+  // `adapter` allows custom handling of requests which makes testing easier.
+  // Return a promise and supply a valid response (see lib/adapters/README.md).
+  adapter: function (config) {
+    /* ... */
+  },
+
+  // `auth` indicates that HTTP Basic auth should be used, and supplies credentials.
+  // This will set an `Authorization` header, overwriting any existing
+  // `Authorization` custom headers you have set using `headers`.
+  auth: {
+    username: 'janedoe',
+    password: 's00pers3cret'
+  },
+
+  // `responseType` indicates the type of data that the server will respond with
+  // options are 'arraybuffer', 'blob', 'document', 'json', 'text', 'stream'
+  responseType: 'json', // default
+
+  // `xsrfCookieName` is the name of the cookie to use as a value for xsrf token
+  xsrfCookieName: 'XSRF-TOKEN', // default
+
+  // `xsrfHeaderName` is the name of the http header that carries the xsrf token value
+  xsrfHeaderName: 'X-XSRF-TOKEN', // default
+
+  // `onUploadProgress` allows handling of progress events for uploads
+  onUploadProgress: function (progressEvent) {
+    // Do whatever you want with the native progress event
+  },
+
+  // `onDownloadProgress` allows handling of progress events for downloads
+  onDownloadProgress: function (progressEvent) {
+    // Do whatever you want with the native progress event
+  },
+
+  // `maxContentLength` defines the max size of the http response content allowed
+  maxContentLength: 2000,
+
+  // `validateStatus` defines whether to resolve or reject the promise for a given
+  // HTTP response status code. If `validateStatus` returns `true` (or is set to `null`
+  // or `undefined`), the promise will be resolved; otherwise, the promise will be
+  // rejected.
+  validateStatus: function (status) {
+    return status >= 200 && status < 300; // default
+  },
+
+  // `maxRedirects` defines the maximum number of redirects to follow in node.js.
+  // If set to 0, no redirects will be followed.
+  maxRedirects: 5, // default
+
+  // `socketPath` defines a UNIX Socket to be used in node.js.
+  // e.g. '/var/run/docker.sock' to send requests to the docker daemon.
+  // Only either `socketPath` or `proxy` can be specified.
+  // If both are specified, `socketPath` is used.
+  socketPath: null, // default
+
+  // `httpAgent` and `httpsAgent` define a custom agent to be used when performing http
+  // and https requests, respectively, in node.js. This allows options to be added like
+  // `keepAlive` that are not enabled by default.
+  httpAgent: new http.Agent({ keepAlive: true }),
+  httpsAgent: new https.Agent({ keepAlive: true }),
+
+  // 'proxy' defines the hostname and port of the proxy server
+  // Use `false` to disable proxies, ignoring environment variables.
+  // `auth` indicates that HTTP Basic auth should be used to connect to the proxy, and
+  // supplies credentials.
+  // This will set an `Proxy-Authorization` header, overwriting any existing
+  // `Proxy-Authorization` custom headers you have set using `headers`.
+  proxy: {
+    host: '127.0.0.1',
+    port: 9000,
+    auth: {
+      username: 'mikeymike',
+      password: 'rapunz3l'
+    }
+  },
+
+  // `cancelToken` specifies a cancel token that can be used to cancel the request
+  // (see Cancellation section below for details)
+  cancelToken: new CancelToken(function (cancel) {
+  })
+}
+```
+
+## Response Schema
+
+The response for a request contains the following information.
+
+```js
+{
+  // `data` is the response that was provided by the server
+  data: {},
+
+  // `status` is the HTTP status code from the server response
+  status: 200,
+
+  // `statusText` is the HTTP status message from the server response
+  statusText: 'OK',
+
+  // `headers` the headers that the server responded with
+  // All header names are lower cased
+  headers: {},
+
+  // `config` is the config that was provided to `axios` for the request
+  config: {},
+
+  // `request` is the request that generated this response
+  // It is the last ClientRequest instance in node.js (in redirects)
+  // and an XMLHttpRequest instance the browser
+  request: {}
+}
+```
+
+When using `then`, you will receive the response as follows:
+
+```js
+axios.get('/user/12345')
+  .then(function(response) {
+    console.log(response.data);
+    console.log(response.status);
+    console.log(response.statusText);
+    console.log(response.headers);
+    console.log(response.config);
+  });
+```
+
+When using `catch`, or passing a [rejection callback](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/then) as second parameter of `then`, the response will be available through the `error` object as explained in the [Handling Errors](#handling-errors) section.
+
+## Config Defaults
+
+You can specify config defaults that will be applied to every request.
+
+### Global axios defaults
+
+```js
+axios.defaults.baseURL = 'https://api.example.com';
+axios.defaults.headers.common['Authorization'] = AUTH_TOKEN;
+axios.defaults.headers.post['Content-Type'] = 'application/x-www-form-urlencoded';
+```
+
+### Custom instance defaults
+
+```js
+// Set config defaults when creating the instance
+var instance = axios.create({
+  baseURL: 'https://api.example.com'
+});
+
+// Alter defaults after instance has been created
+instance.defaults.headers.common['Authorization'] = AUTH_TOKEN;
+```
+
+### Config order of precedence
+
+Config will be merged with an order of precedence. The order is library defaults found in [lib/defaults.js](https://github.com/axios/axios/blob/master/lib/defaults.js#L28), then `defaults` property of the instance, and finally `config` argument for the request. The latter will take precedence over the former. Here's an example.
+
+```js
+// Create an instance using the config defaults provided by the library
+// At this point the timeout config value is `0` as is the default for the library
+var instance = axios.create();
+
+// Override timeout default for the library
+// Now all requests will wait 2.5 seconds before timing out
+instance.defaults.timeout = 2500;
+
+// Override timeout for this request as it's known to take a long time
+instance.get('/longRequest', {
+  timeout: 5000
+});
+```
+
+## Interceptors
+
+You can intercept requests or responses before they are handled by `then` or `catch`.
+
+```js
+// Add a request interceptor
+axios.interceptors.request.use(function (config) {
+    // Do something before request is sent
+    return config;
+  }, function (error) {
+    // Do something with request error
+    return Promise.reject(error);
+  });
+
+// Add a response interceptor
+axios.interceptors.response.use(function (response) {
+    // Do something with response data
+    return response;
+  }, function (error) {
+    // Do something with response error
+    return Promise.reject(error);
+  });
+```
+
+If you may need to remove an interceptor later you can.
+
+```js
+var myInterceptor = axios.interceptors.request.use(function () {/*...*/});
+axios.interceptors.request.eject(myInterceptor);
+```
+
+You can add interceptors to a custom instance of axios.
+
+```js
+var instance = axios.create();
+instance.interceptors.request.use(function () {/*...*/});
+```
+
+## Handling Errors
+
+```js
+axios.get('/user/12345')
+  .catch(function (error) {
+    if (error.response) {
+      // The request was made and the server responded with a status code
+      // that falls out of the range of 2xx
+      console.log(error.response.data);
+      console.log(error.response.status);
+      console.log(error.response.headers);
+    } else if (error.request) {
+      // The request was made but no response was received
+      // `error.request` is an instance of XMLHttpRequest in the browser and an instance of
+      // http.ClientRequest in node.js
+      console.log(error.request);
+    } else {
+      // Something happened in setting up the request that triggered an Error
+      console.log('Error', error.message);
+    }
+    console.log(error.config);
+  });
+```
+
+You can define a custom HTTP status code error range using the `validateStatus` config option.
+
+```js
+axios.get('/user/12345', {
+  validateStatus: function (status) {
+    return status < 500; // Reject only if the status code is greater than or equal to 500
+  }
+})
+```
+
+## Cancellation
+
+You can cancel a request using a *cancel token*.
+
+> The axios cancel token API is based on the withdrawn [cancelable promises proposal](https://github.com/tc39/proposal-cancelable-promises).
+
+You can create a cancel token using the `CancelToken.source` factory as shown below:
+
+```js
+var CancelToken = axios.CancelToken;
+var source = CancelToken.source();
+
+axios.get('/user/12345', {
+  cancelToken: source.token
+}).catch(function(thrown) {
+  if (axios.isCancel(thrown)) {
+    console.log('Request canceled', thrown.message);
+  } else {
+    // handle error
+  }
+});
+
+axios.post('/user/12345', {
+  name: 'new name'
+}, {
+  cancelToken: source.token
+})
+
+// cancel the request (the message parameter is optional)
+source.cancel('Operation canceled by the user.');
+```
+
+You can also create a cancel token by passing an executor function to the `CancelToken` constructor:
+
+```js
+var CancelToken = axios.CancelToken;
+var cancel;
+
+axios.get('/user/12345', {
+  cancelToken: new CancelToken(function executor(c) {
+    // An executor function receives a cancel function as a parameter
+    cancel = c;
+  })
+});
+
+// cancel the request
+cancel();
+```
+
+> Note: you can cancel several requests with the same cancel token.
+
+## Using application/x-www-form-urlencoded format
+
+By default, axios serializes JavaScript objects to `JSON`. To send data in the `application/x-www-form-urlencoded` format instead, you can use one of the following options.
+
+### Browser
+
+In a browser, you can use the [`URLSearchParams`](https://developer.mozilla.org/en-US/docs/Web/API/URLSearchParams) API as follows:
+
+```js
+var params = new URLSearchParams();
+params.append('param1', 'value1');
+params.append('param2', 'value2');
+axios.post('/foo', params);
+```
+
+> Note that `URLSearchParams` is not supported by all browsers (see [caniuse.com](http://www.caniuse.com/#feat=urlsearchparams)), but there is a [polyfill](https://github.com/WebReflection/url-search-params) available (make sure to polyfill the global environment).
+
+Alternatively, you can encode data using the [`qs`](https://github.com/ljharb/qs) library:
+
+```js
+var qs = require('qs');
+axios.post('/foo', qs.stringify({ 'bar': 123 }));
+```
+
+### Node.js
+
+In node.js, you can use the [`querystring`](https://nodejs.org/api/querystring.html) module as follows:
+
+```js
+var querystring = require('querystring');
+axios.post('http://something.com/', querystring.stringify({ foo: 'bar' }));
+```
+
+You can also use the [`qs`](https://github.com/ljharb/qs) library.
+
+## Semver
+
+Until axios reaches a `1.0` release, breaking changes will be released with a new minor version. For example `0.5.1`, and `0.5.4` will have the same API, but `0.6.0` will have breaking changes.
+
+## Promises
+
+axios depends on a native ES6 Promise implementation to be [supported](http://caniuse.com/promises).
+If your environment doesn't support ES6 Promises, you can [polyfill](https://github.com/jakearchibald/es6-promise).
+
+## TypeScript
+axios includes [TypeScript](http://typescriptlang.org) definitions.
+```typescript
+import axios from 'axios';
+axios.get('/user?ID=12345');
+```
+
+## Resources
+
+* [Changelog](https://github.com/axios/axios/blob/master/CHANGELOG.md)
+* [Upgrade Guide](https://github.com/axios/axios/blob/master/UPGRADE_GUIDE.md)
+* [Ecosystem](https://github.com/axios/axios/blob/master/ECOSYSTEM.md)
+* [Contributing Guide](https://github.com/axios/axios/blob/master/CONTRIBUTING.md)
+* [Code of Conduct](https://github.com/axios/axios/blob/master/CODE_OF_CONDUCT.md)
+
+## Credits
+
+axios is heavily inspired by the [$http service](https://docs.angularjs.org/api/ng/service/$http) provided in [Angular](https://angularjs.org/). Ultimately axios is an effort to provide a standalone `$http`-like service for use outside of Angular.
+
+## License
+
+MIT

express-server/node_modules/axios/UPGRADE_GUIDE.md

@@ -0,0 +1,162 @@
+# Upgrade Guide
+
+### 0.15.x -> 0.16.0
+
+#### `Promise` Type Declarations
+
+The `Promise` type declarations have been removed from the axios typings in favor of the built-in type declarations. If you use axios in a TypeScript project that targets `ES5`, please make sure to include the `es2015.promise` lib. Please see [this post](https://blog.mariusschulz.com/2016/11/25/typescript-2-0-built-in-type-declarations) for details.
+
+### 0.13.x -> 0.14.0
+
+#### TypeScript Definitions
+
+The axios TypeScript definitions have been updated to match the axios API and use the ES2015 module syntax.
+
+Please use the following `import` statement to import axios in TypeScript:
+
+```typescript
+import axios from 'axios';
+
+axios.get('/foo')
+  .then(response => console.log(response))
+  .catch(error => console.log(error));
+```
+
+#### `agent` Config Option
+
+The `agent` config option has been replaced with two new options: `httpAgent` and `httpsAgent`. Please use them instead.
+
+```js
+{
+  // Define a custom agent for HTTP
+  httpAgent: new http.Agent({ keepAlive: true }),
+  // Define a custom agent for HTTPS
+  httpsAgent: new https.Agent({ keepAlive: true })
+}
+```
+
+#### `progress` Config Option
+
+The `progress` config option has been replaced with the `onUploadProgress` and `onDownloadProgress` options.
+
+```js
+{
+  // Define a handler for upload progress events
+  onUploadProgress: function (progressEvent) {
+    // ...
+  },
+
+  // Define a handler for download progress events
+  onDownloadProgress: function (progressEvent) {
+    // ...
+  }
+}
+```
+
+### 0.12.x -> 0.13.0
+
+The `0.13.0` release contains several changes to custom adapters and error handling.
+
+#### Error Handling
+
+Previous to this release an error could either be a server response with bad status code or an actual `Error`. With this release Promise will always reject with an `Error`. In the case that a response was received, the `Error` will also include the response.
+
+```js
+axios.get('/user/12345')
+  .catch((error) => {
+    console.log(error.message);
+    console.log(error.code); // Not always specified
+    console.log(error.config); // The config that was used to make the request
+    console.log(error.response); // Only available if response was received from the server
+  });
+```
+
+#### Request Adapters
+
+This release changes a few things about how request adapters work. Please take note if you are using your own custom adapter.
+
+1. Response transformer is now called outside of adapter.
+2. Request adapter returns a `Promise`.
+
+This means that you no longer need to invoke `transformData` on response data. You will also no longer receive `resolve` and `reject` as arguments in your adapter.
+
+Previous code:
+
+```js
+function myAdapter(resolve, reject, config) {
+  var response = {
+    data: transformData(
+      responseData,
+      responseHeaders,
+      config.transformResponse
+    ),
+    status: request.status,
+    statusText: request.statusText,
+    headers: responseHeaders
+  };
+  settle(resolve, reject, response);
+}
+```
+
+New code:
+
+```js
+function myAdapter(config) {
+  return new Promise(function (resolve, reject) {
+    var response = {
+      data: responseData,
+      status: request.status,
+      statusText: request.statusText,
+      headers: responseHeaders
+    };
+    settle(resolve, reject, response);
+  });
+}
+```
+
+See the related commits for more details:
+- [Response transformers](https://github.com/axios/axios/commit/10eb23865101f9347570552c04e9d6211376e25e)
+- [Request adapter Promise](https://github.com/axios/axios/commit/157efd5615890301824e3121cc6c9d2f9b21f94a)
+
+### 0.5.x -> 0.6.0
+
+The `0.6.0` release contains mostly bug fixes, but there are a couple things to be aware of when upgrading.
+
+#### ES6 Promise Polyfill
+
+Up until the `0.6.0` release ES6 `Promise` was being polyfilled using [es6-promise](https://github.com/jakearchibald/es6-promise). With this release, the polyfill has been removed, and you will need to supply it yourself if your environment needs it.
+
+```js
+require('es6-promise').polyfill();
+var axios = require('axios');
+```
+
+This will polyfill the global environment, and only needs to be done once.
+
+#### `axios.success`/`axios.error`
+
+The `success`, and `error` aliases were deprectated in [0.4.0](https://github.com/axios/axios/blob/master/CHANGELOG.md#040-oct-03-2014). As of this release they have been removed entirely. Instead please use `axios.then`, and `axios.catch` respectively.
+
+```js
+axios.get('some/url')
+  .then(function (res) {
+    /* ... */
+  })
+  .catch(function (err) {
+    /* ... */
+  });
+```
+
+#### UMD
+
+Previous versions of axios shipped with an AMD, CommonJS, and Global build. This has all been rolled into a single UMD build.
+
+```js
+// AMD
+require(['bower_components/axios/dist/axios'], function (axios) {
+  /* ... */
+});
+
+// CommonJS
+var axios = require('axios/dist/axios');
+```

express-server/node_modules/axios/index.d.ts

@@ -0,0 +1,131 @@
+export interface AxiosTransformer {
+  (data: any, headers?: any): any;
+}
+
+export interface AxiosAdapter {
+  (config: AxiosRequestConfig): AxiosPromise<any>;
+}
+
+export interface AxiosBasicCredentials {
+  username: string;
+  password: string;
+}
+
+export interface AxiosProxyConfig {
+  host: string;
+  port: number;
+  auth?: {
+    username: string;
+    password:string;
+  }
+}
+
+export interface AxiosRequestConfig {
+  url?: string;
+  method?: string;
+  baseURL?: string;
+  transformRequest?: AxiosTransformer | AxiosTransformer[];
+  transformResponse?: AxiosTransformer | AxiosTransformer[];
+  headers?: any;
+  params?: any;
+  paramsSerializer?: (params: any) => string;
+  data?: any;
+  timeout?: number;
+  withCredentials?: boolean;
+  adapter?: AxiosAdapter;
+  auth?: AxiosBasicCredentials;
+  responseType?: string;
+  xsrfCookieName?: string;
+  xsrfHeaderName?: string;
+  onUploadProgress?: (progressEvent: any) => void;
+  onDownloadProgress?: (progressEvent: any) => void;
+  maxContentLength?: number;
+  validateStatus?: (status: number) => boolean;
+  maxRedirects?: number;
+  httpAgent?: any;
+  httpsAgent?: any;
+  proxy?: AxiosProxyConfig | false;
+  cancelToken?: CancelToken;
+}
+
+export interface AxiosResponse<T = any>  {
+  data: T;
+  status: number;
+  statusText: string;
+  headers: any;
+  config: AxiosRequestConfig;
+  request?: any;
+}
+
+export interface AxiosError extends Error {
+  config: AxiosRequestConfig;
+  code?: string;
+  request?: any;
+  response?: AxiosResponse;
+}
+
+export interface AxiosPromise<T = any> extends Promise<AxiosResponse<T>> {
+}
+
+export interface CancelStatic {
+  new (message?: string): Cancel;
+}
+
+export interface Cancel {
+  message: string;
+}
+
+export interface Canceler {
+  (message?: string): void;
+}
+
+export interface CancelTokenStatic {
+  new (executor: (cancel: Canceler) => void): CancelToken;
+  source(): CancelTokenSource;
+}
+
+export interface CancelToken {
+  promise: Promise<Cancel>;
+  reason?: Cancel;
+  throwIfRequested(): void;
+}
+
+export interface CancelTokenSource {
+  token: CancelToken;
+  cancel: Canceler;
+}
+
+export interface AxiosInterceptorManager<V> {
+  use(onFulfilled?: (value: V) => V | Promise<V>, onRejected?: (error: any) => any): number;
+  eject(id: number): void;
+}
+
+export interface AxiosInstance {
+  (config: AxiosRequestConfig): AxiosPromise;
+  (url: string, config?: AxiosRequestConfig): AxiosPromise;
+  defaults: AxiosRequestConfig;
+  interceptors: {
+    request: AxiosInterceptorManager<AxiosRequestConfig>;
+    response: AxiosInterceptorManager<AxiosResponse>;
+  };
+  request<T = any>(config: AxiosRequestConfig): AxiosPromise<T>;
+  get<T = any>(url: string, config?: AxiosRequestConfig): AxiosPromise<T>;
+  delete(url: string, config?: AxiosRequestConfig): AxiosPromise;
+  head(url: string, config?: AxiosRequestConfig): AxiosPromise;
+  post<T = any>(url: string, data?: any, config?: AxiosRequestConfig): AxiosPromise<T>;
+  put<T = any>(url: string, data?: any, config?: AxiosRequestConfig): AxiosPromise<T>;
+  patch<T = any>(url: string, data?: any, config?: AxiosRequestConfig): AxiosPromise<T>;
+}
+
+export interface AxiosStatic extends AxiosInstance {
+  create(config?: AxiosRequestConfig): AxiosInstance;
+  Cancel: CancelStatic;
+  CancelToken: CancelTokenStatic;
+  isCancel(value: any): boolean;
+  all<T>(values: (T | Promise<T>)[]): Promise<T[]>;
+  spread<T, R>(callback: (...args: T[]) => R): (array: T[]) => R;
+}
+
+declare const Axios: AxiosStatic;
+
+export default Axios;

express-server/node_modules/axios/index.js

@@ -0,0 +1 @@
+module.exports = require('./lib/axios');

express-server/node_modules/axios/lib/adapters/README.md

@@ -0,0 +1,37 @@
+# axios // adapters
+
+The modules under `adapters/` are modules that handle dispatching a request and settling a returned `Promise` once a response is received.
+
+## Example
+
+```js
+var settle = require('./../core/settle');
+
+module.exports = function myAdapter(config) {
+  // At this point:
+  //  - config has been merged with defaults
+  //  - request transformers have already run
+  //  - request interceptors have already run
+  
+  // Make the request using config provided
+  // Upon response settle the Promise
+
+  return new Promise(function(resolve, reject) {
+  
+    var response = {
+      data: responseData,
+      status: request.status,
+      statusText: request.statusText,
+      headers: responseHeaders,
+      config: config,
+      request: request
+    };
+
+    settle(resolve, reject, response);
+
+    // From here:
+    //  - response transformers will run
+    //  - response interceptors will run
+  });
+}
+```

express-server/node_modules/axios/lib/adapters/http.js

@@ -0,0 +1,237 @@
+'use strict';
+
+var utils = require('./../utils');
+var settle = require('./../core/settle');
+var buildURL = require('./../helpers/buildURL');
+var http = require('http');
+var https = require('https');
+var httpFollow = require('follow-redirects').http;
+var httpsFollow = require('follow-redirects').https;
+var url = require('url');
+var zlib = require('zlib');
+var pkg = require('./../../package.json');
+var createError = require('../core/createError');
+var enhanceError = require('../core/enhanceError');
+
+/*eslint consistent-return:0*/
+module.exports = function httpAdapter(config) {
+  return new Promise(function dispatchHttpRequest(resolve, reject) {
+    var data = config.data;
+    var headers = config.headers;
+    var timer;
+
+    // Set User-Agent (required by some servers)
+    // Only set header if it hasn't been set in config
+    // See https://github.com/axios/axios/issues/69
+    if (!headers['User-Agent'] && !headers['user-agent']) {
+      headers['User-Agent'] = 'axios/' + pkg.version;
+    }
+
+    if (data && !utils.isStream(data)) {
+      if (Buffer.isBuffer(data)) {
+        // Nothing to do...
+      } else if (utils.isArrayBuffer(data)) {
+        data = new Buffer(new Uint8Array(data));
+      } else if (utils.isString(data)) {
+        data = new Buffer(data, 'utf-8');
+      } else {
+        return reject(createError(
+          'Data after transformation must be a string, an ArrayBuffer, a Buffer, or a Stream',
+          config
+        ));
+      }
+
+      // Add Content-Length header if data exists
+      headers['Content-Length'] = data.length;
+    }
+
+    // HTTP basic authentication
+    var auth = undefined;
+    if (config.auth) {
+      var username = config.auth.username || '';
+      var password = config.auth.password || '';
+      auth = username + ':' + password;
+    }
+
+    // Parse url
+    var parsed = url.parse(config.url);
+    var protocol = parsed.protocol || 'http:';
+
+    if (!auth && parsed.auth) {
+      var urlAuth = parsed.auth.split(':');
+      var urlUsername = urlAuth[0] || '';
+      var urlPassword = urlAuth[1] || '';
+      auth = urlUsername + ':' + urlPassword;
+    }
+
+    if (auth) {
+      delete headers.Authorization;
+    }
+
+    var isHttps = protocol === 'https:';
+    var agent = isHttps ? config.httpsAgent : config.httpAgent;
+
+    var options = {
+      path: buildURL(parsed.path, config.params, config.paramsSerializer).replace(/^\?/, ''),
+      method: config.method,
+      headers: headers,
+      agent: agent,
+      auth: auth
+    };
+
+    if (config.socketPath) {
+      options.socketPath = config.socketPath;
+    } else {
+      options.hostname = parsed.hostname;
+      options.port = parsed.port;
+    }
+
+    var proxy = config.proxy;
+    if (!proxy && proxy !== false) {
+      var proxyEnv = protocol.slice(0, -1) + '_proxy';
+      var proxyUrl = process.env[proxyEnv] || process.env[proxyEnv.toUpperCase()];
+      if (proxyUrl) {
+        var parsedProxyUrl = url.parse(proxyUrl);
+        proxy = {
+          host: parsedProxyUrl.hostname,
+          port: parsedProxyUrl.port
+        };
+
+        if (parsedProxyUrl.auth) {
+          var proxyUrlAuth = parsedProxyUrl.auth.split(':');
+          proxy.auth = {
+            username: proxyUrlAuth[0],
+            password: proxyUrlAuth[1]
+          };
+        }
+      }
+    }
+
+    if (proxy) {
+      options.hostname = proxy.host;
+      options.host = proxy.host;
+      options.headers.host = parsed.hostname + (parsed.port ? ':' + parsed.port : '');
+      options.port = proxy.port;
+      options.path = protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path;
+
+      // Basic proxy authorization
+      if (proxy.auth) {
+        var base64 = new Buffer(proxy.auth.username + ':' + proxy.auth.password, 'utf8').toString('base64');
+        options.headers['Proxy-Authorization'] = 'Basic ' + base64;
+      }
+    }
+
+    var transport;
+    if (config.transport) {
+      transport = config.transport;
+    } else if (config.maxRedirects === 0) {
+      transport = isHttps ? https : http;
+    } else {
+      if (config.maxRedirects) {
+        options.maxRedirects = config.maxRedirects;
+      }
+      transport = isHttps ? httpsFollow : httpFollow;
+    }
+
+    if (config.maxContentLength && config.maxContentLength > -1) {
+      options.maxBodyLength = config.maxContentLength;
+    }
+
+    // Create the request
+    var req = transport.request(options, function handleResponse(res) {
+      if (req.aborted) return;
+
+      // Response has been received so kill timer that handles request timeout
+      clearTimeout(timer);
+      timer = null;
+
+      // uncompress the response body transparently if required
+      var stream = res;
+      switch (res.headers['content-encoding']) {
+      /*eslint default-case:0*/
+      case 'gzip':
+      case 'compress':
+      case 'deflate':
+        // add the unzipper to the body stream processing pipeline
+        stream = stream.pipe(zlib.createUnzip());
+
+        // remove the content-encoding in order to not confuse downstream operations
+        delete res.headers['content-encoding'];
+        break;
+      }
+
+      // return the last request in case of redirects
+      var lastRequest = res.req || req;
+
+      var response = {
+        status: res.statusCode,
+        statusText: res.statusMessage,
+        headers: res.headers,
+        config: config,
+        request: lastRequest
+      };
+
+      if (config.responseType === 'stream') {
+        response.data = stream;
+        settle(resolve, reject, response);
+      } else {
+        var responseBuffer = [];
+        stream.on('data', function handleStreamData(chunk) {
+          responseBuffer.push(chunk);
+
+          // make sure the content length is not over the maxContentLength if specified
+          if (config.maxContentLength > -1 && Buffer.concat(responseBuffer).length > config.maxContentLength) {
+            reject(createError('maxContentLength size of ' + config.maxContentLength + ' exceeded',
+              config, null, lastRequest));
+          }
+        });
+
+        stream.on('error', function handleStreamError(err) {
+          if (req.aborted) return;
+          reject(enhanceError(err, config, null, lastRequest));
+        });
+
+        stream.on('end', function handleStreamEnd() {
+          var responseData = Buffer.concat(responseBuffer);
+          if (config.responseType !== 'arraybuffer') {
+            responseData = responseData.toString('utf8');
+          }
+
+          response.data = responseData;
+          settle(resolve, reject, response);
+        });
+      }
+    });
+
+    // Handle errors
+    req.on('error', function handleRequestError(err) {
+      if (req.aborted) return;
+      reject(enhanceError(err, config, null, req));
+    });
+
+    // Handle request timeout
+    if (config.timeout && !timer) {
+      timer = setTimeout(function handleRequestTimeout() {
+        req.abort();
+        reject(createError('timeout of ' + config.timeout + 'ms exceeded', config, 'ECONNABORTED', req));
+      }, config.timeout);
+    }
+
+    if (config.cancelToken) {
+      // Handle cancellation
+      config.cancelToken.promise.then(function onCanceled(cancel) {
+        if (req.aborted) return;
+
+        req.abort();
+        reject(cancel);
+      });
+    }
+
+    // Send the request
+    if (utils.isStream(data)) {
+      data.pipe(req);
+    } else {
+      req.end(data);
+    }
+  });
+};

express-server/node_modules/axios/lib/adapters/xhr.js

@@ -0,0 +1,180 @@
+'use strict';
+
+var utils = require('./../utils');
+var settle = require('./../core/settle');
+var buildURL = require('./../helpers/buildURL');
+var parseHeaders = require('./../helpers/parseHeaders');
+var isURLSameOrigin = require('./../helpers/isURLSameOrigin');
+var createError = require('../core/createError');
+var btoa = (typeof window !== 'undefined' && window.btoa && window.btoa.bind(window)) || require('./../helpers/btoa');
+
+module.exports = function xhrAdapter(config) {
+  return new Promise(function dispatchXhrRequest(resolve, reject) {
+    var requestData = config.data;
+    var requestHeaders = config.headers;
+
+    if (utils.isFormData(requestData)) {
+      delete requestHeaders['Content-Type']; // Let the browser set it
+    }
+
+    var request = new XMLHttpRequest();
+    var loadEvent = 'onreadystatechange';
+    var xDomain = false;
+
+    // For IE 8/9 CORS support
+    // Only supports POST and GET calls and doesn't returns the response headers.
+    // DON'T do this for testing b/c XMLHttpRequest is mocked, not XDomainRequest.
+    if (process.env.NODE_ENV !== 'test' &&
+        typeof window !== 'undefined' &&
+        window.XDomainRequest && !('withCredentials' in request) &&
+        !isURLSameOrigin(config.url)) {
+      request = new window.XDomainRequest();
+      loadEvent = 'onload';
+      xDomain = true;
+      request.onprogress = function handleProgress() {};
+      request.ontimeout = function handleTimeout() {};
+    }
+
+    // HTTP basic authentication
+    if (config.auth) {
+      var username = config.auth.username || '';
+      var password = config.auth.password || '';
+      requestHeaders.Authorization = 'Basic ' + btoa(username + ':' + password);
+    }
+
+    request.open(config.method.toUpperCase(), buildURL(config.url, config.params, config.paramsSerializer), true);
+
+    // Set the request timeout in MS
+    request.timeout = config.timeout;
+
+    // Listen for ready state
+    request[loadEvent] = function handleLoad() {
+      if (!request || (request.readyState !== 4 && !xDomain)) {
+        return;
+      }
+
+      // The request errored out and we didn't get a response, this will be
+      // handled by onerror instead
+      // With one exception: request that using file: protocol, most browsers
+      // will return status as 0 even though it's a successful request
+      if (request.status === 0 && !(request.responseURL && request.responseURL.indexOf('file:') === 0)) {
+        return;
+      }
+
+      // Prepare the response
+      var responseHeaders = 'getAllResponseHeaders' in request ? parseHeaders(request.getAllResponseHeaders()) : null;
+      var responseData = !config.responseType || config.responseType === 'text' ? request.responseText : request.response;
+      var response = {
+        data: responseData,
+        // IE sends 1223 instead of 204 (https://github.com/axios/axios/issues/201)
+        status: request.status === 1223 ? 204 : request.status,
+        statusText: request.status === 1223 ? 'No Content' : request.statusText,
+        headers: responseHeaders,
+        config: config,
+        request: request
+      };
+
+      settle(resolve, reject, response);
+
+      // Clean up request
+      request = null;
+    };
+
+    // Handle low level network errors
+    request.onerror = function handleError() {
+      // Real errors are hidden from us by the browser
+      // onerror should only fire if it's a network error
+      reject(createError('Network Error', config, null, request));
+
+      // Clean up request
+      request = null;
+    };
+
+    // Handle timeout
+    request.ontimeout = function handleTimeout() {
+      reject(createError('timeout of ' + config.timeout + 'ms exceeded', config, 'ECONNABORTED',
+        request));
+
+      // Clean up request
+      request = null;
+    };
+
+    // Add xsrf header
+    // This is only done if running in a standard browser environment.
+    // Specifically not if we're in a web worker, or react-native.
+    if (utils.isStandardBrowserEnv()) {
+      var cookies = require('./../helpers/cookies');
+
+      // Add xsrf header
+      var xsrfValue = (config.withCredentials || isURLSameOrigin(config.url)) && config.xsrfCookieName ?
+          cookies.read(config.xsrfCookieName) :
+          undefined;
+
+      if (xsrfValue) {
+        requestHeaders[config.xsrfHeaderName] = xsrfValue;
+      }
+    }
+
+    // Add headers to the request
+    if ('setRequestHeader' in request) {
+      utils.forEach(requestHeaders, function setRequestHeader(val, key) {
+        if (typeof requestData === 'undefined' && key.toLowerCase() === 'content-type') {
+          // Remove Content-Type if data is undefined
+          delete requestHeaders[key];
+        } else {
+          // Otherwise add header to the request
+          request.setRequestHeader(key, val);
+        }
+      });
+    }
+
+    // Add withCredentials to request if needed
+    if (config.withCredentials) {
+      request.withCredentials = true;
+    }
+
+    // Add responseType to request if needed
+    if (config.responseType) {
+      try {
+        request.responseType = config.responseType;
+      } catch (e) {
+        // Expected DOMException thrown by browsers not compatible XMLHttpRequest Level 2.
+        // But, this can be suppressed for 'json' type as it can be parsed by default 'transformResponse' function.
+        if (config.responseType !== 'json') {
+          throw e;
+        }
+      }
+    }
+
+    // Handle progress if needed
+    if (typeof config.onDownloadProgress === 'function') {
+      request.addEventListener('progress', config.onDownloadProgress);
+    }
+
+    // Not all browsers support upload events
+    if (typeof config.onUploadProgress === 'function' && request.upload) {
+      request.upload.addEventListener('progress', config.onUploadProgress);
+    }
+
+    if (config.cancelToken) {
+      // Handle cancellation
+      config.cancelToken.promise.then(function onCanceled(cancel) {
+        if (!request) {
+          return;
+        }
+
+        request.abort();
+        reject(cancel);
+        // Clean up request
+        request = null;
+      });
+    }
+
+    if (requestData === undefined) {
+      requestData = null;
+    }
+
+    // Send the request
+    request.send(requestData);
+  });
+};

express-server/node_modules/axios/lib/axios.js

@@ -0,0 +1,52 @@
+'use strict';
+
+var utils = require('./utils');
+var bind = require('./helpers/bind');
+var Axios = require('./core/Axios');
+var defaults = require('./defaults');
+
+/**
+ * Create an instance of Axios
+ *
+ * @param {Object} defaultConfig The default config for the instance
+ * @return {Axios} A new instance of Axios
+ */
+function createInstance(defaultConfig) {
+  var context = new Axios(defaultConfig);
+  var instance = bind(Axios.prototype.request, context);
+
+  // Copy axios.prototype to instance
+  utils.extend(instance, Axios.prototype, context);
+
+  // Copy context to instance
+  utils.extend(instance, context);
+
+  return instance;
+}
+
+// Create the default instance to be exported
+var axios = createInstance(defaults);
+
+// Expose Axios class to allow class inheritance
+axios.Axios = Axios;
+
+// Factory for creating new instances
+axios.create = function create(instanceConfig) {
+  return createInstance(utils.merge(defaults, instanceConfig));
+};
+
+// Expose Cancel & CancelToken
+axios.Cancel = require('./cancel/Cancel');
+axios.CancelToken = require('./cancel/CancelToken');
+axios.isCancel = require('./cancel/isCancel');
+
+// Expose all/spread
+axios.all = function all(promises) {
+  return Promise.all(promises);
+};
+axios.spread = require('./helpers/spread');
+
+module.exports = axios;
+
+// Allow use of default import syntax in TypeScript
+module.exports.default = axios;

express-server/node_modules/axios/lib/cancel/Cancel.js

@@ -0,0 +1,19 @@
+'use strict';
+
+/**
+ * A `Cancel` is an object that is thrown when an operation is canceled.
+ *
+ * @class
+ * @param {string=} message The message.
+ */
+function Cancel(message) {
+  this.message = message;
+}
+
+Cancel.prototype.toString = function toString() {
+  return 'Cancel' + (this.message ? ': ' + this.message : '');
+};
+
+Cancel.prototype.__CANCEL__ = true;
+
+module.exports = Cancel;

express-server/node_modules/axios/lib/cancel/CancelToken.js

@@ -0,0 +1,57 @@
+'use strict';
+
+var Cancel = require('./Cancel');
+
+/**
+ * A `CancelToken` is an object that can be used to request cancellation of an operation.
+ *
+ * @class
+ * @param {Function} executor The executor function.
+ */
+function CancelToken(executor) {
+  if (typeof executor !== 'function') {
+    throw new TypeError('executor must be a function.');
+  }
+
+  var resolvePromise;
+  this.promise = new Promise(function promiseExecutor(resolve) {
+    resolvePromise = resolve;
+  });
+
+  var token = this;
+  executor(function cancel(message) {
+    if (token.reason) {
+      // Cancellation has already been requested
+      return;
+    }
+
+    token.reason = new Cancel(message);
+    resolvePromise(token.reason);
+  });
+}
+
+/**
+ * Throws a `Cancel` if cancellation has been requested.
+ */
+CancelToken.prototype.throwIfRequested = function throwIfRequested() {
+  if (this.reason) {
+    throw this.reason;
+  }
+};
+
+/**
+ * Returns an object that contains a new `CancelToken` and a function that, when called,
+ * cancels the `CancelToken`.
+ */
+CancelToken.source = function source() {
+  var cancel;
+  var token = new CancelToken(function executor(c) {
+    cancel = c;
+  });
+  return {
+    token: token,
+    cancel: cancel
+  };
+};
+
+module.exports = CancelToken;

express-server/node_modules/axios/lib/cancel/isCancel.js

@@ -0,0 +1,5 @@
+'use strict';
+
+module.exports = function isCancel(value) {
+  return !!(value && value.__CANCEL__);
+};

express-server/node_modules/axios/lib/core/Axios.js

@@ -0,0 +1,79 @@
+'use strict';
+
+var defaults = require('./../defaults');
+var utils = require('./../utils');
+var InterceptorManager = require('./InterceptorManager');
+var dispatchRequest = require('./dispatchRequest');
+
+/**
+ * Create a new instance of Axios
+ *
+ * @param {Object} instanceConfig The default config for the instance
+ */
+function Axios(instanceConfig) {
+  this.defaults = instanceConfig;
+  this.interceptors = {
+    request: new InterceptorManager(),
+    response: new InterceptorManager()
+  };
+}
+
+/**
+ * Dispatch a request
+ *
+ * @param {Object} config The config specific for this request (merged with this.defaults)
+ */
+Axios.prototype.request = function request(config) {
+  /*eslint no-param-reassign:0*/
+  // Allow for axios('example/url'[, config]) a la fetch API
+  if (typeof config === 'string') {
+    config = utils.merge({
+      url: arguments[0]
+    }, arguments[1]);
+  }
+
+  config = utils.merge(defaults, {method: 'get'}, this.defaults, config);
+  config.method = config.method.toLowerCase();
+
+  // Hook up interceptors middleware
+  var chain = [dispatchRequest, undefined];
+  var promise = Promise.resolve(config);
+
+  this.interceptors.request.forEach(function unshiftRequestInterceptors(interceptor) {
+    chain.unshift(interceptor.fulfilled, interceptor.rejected);
+  });
+
+  this.interceptors.response.forEach(function pushResponseInterceptors(interceptor) {
+    chain.push(interceptor.fulfilled, interceptor.rejected);
+  });
+
+  while (chain.length) {
+    promise = promise.then(chain.shift(), chain.shift());
+  }
+
+  return promise;
+};
+
+// Provide aliases for supported request methods
+utils.forEach(['delete', 'get', 'head', 'options'], function forEachMethodNoData(method) {
+  /*eslint func-names:0*/
+  Axios.prototype[method] = function(url, config) {
+    return this.request(utils.merge(config || {}, {
+      method: method,
+      url: url
+    }));
+  };
+});
+
+utils.forEach(['post', 'put', 'patch'], function forEachMethodWithData(method) {
+  /*eslint func-names:0*/
+  Axios.prototype[method] = function(url, data, config) {
+    return this.request(utils.merge(config || {}, {
+      method: method,
+      url: url,
+      data: data
+    }));
+  };
+});
+
+module.exports = Axios;

express-server/node_modules/axios/lib/core/InterceptorManager.js

@@ -0,0 +1,52 @@
+'use strict';
+
+var utils = require('./../utils');
+
+function InterceptorManager() {
+  this.handlers = [];
+}
+
+/**
+ * Add a new interceptor to the stack
+ *
+ * @param {Function} fulfilled The function to handle `then` for a `Promise`
+ * @param {Function} rejected The function to handle `reject` for a `Promise`
+ *
+ * @return {Number} An ID used to remove interceptor later
+ */
+InterceptorManager.prototype.use = function use(fulfilled, rejected) {
+  this.handlers.push({
+    fulfilled: fulfilled,
+    rejected: rejected
+  });
+  return this.handlers.length - 1;
+};
+
+/**
+ * Remove an interceptor from the stack
+ *
+ * @param {Number} id The ID that was returned by `use`
+ */
+InterceptorManager.prototype.eject = function eject(id) {
+  if (this.handlers[id]) {
+    this.handlers[id] = null;
+  }
+};
+
+/**
+ * Iterate over all the registered interceptors
+ *
+ * This method is particularly useful for skipping over any
+ * interceptors that may have become `null` calling `eject`.
+ *
+ * @param {Function} fn The function to call for each interceptor
+ */
+InterceptorManager.prototype.forEach = function forEach(fn) {
+  utils.forEach(this.handlers, function forEachHandler(h) {
+    if (h !== null) {
+      fn(h);
+    }
+  });
+};
+
+module.exports = InterceptorManager;

express-server/node_modules/axios/lib/core/README.md

@@ -0,0 +1,7 @@
+# axios // core
+
+The modules found in `core/` should be modules that are specific to the domain logic of axios. These modules would most likely not make sense to be consumed outside of the axios module, as their logic is too specific. Some examples of core modules are:
+
+- Dispatching requests
+- Managing interceptors
+- Handling config

express-server/node_modules/axios/lib/core/createError.js

@@ -0,0 +1,18 @@
+'use strict';
+
+var enhanceError = require('./enhanceError');
+
+/**
+ * Create an Error with the specified message, config, error code, request and response.
+ *
+ * @param {string} message The error message.
+ * @param {Object} config The config.
+ * @param {string} [code] The error code (for example, 'ECONNABORTED').
+ * @param {Object} [request] The request.
+ * @param {Object} [response] The response.
+ * @returns {Error} The created error.
+ */
+module.exports = function createError(message, config, code, request, response) {
+  var error = new Error(message);
+  return enhanceError(error, config, code, request, response);
+};

express-server/node_modules/axios/lib/core/dispatchRequest.js

@@ -0,0 +1,86 @@
+'use strict';
+
+var utils = require('./../utils');
+var transformData = require('./transformData');
+var isCancel = require('../cancel/isCancel');
+var defaults = require('../defaults');
+var isAbsoluteURL = require('./../helpers/isAbsoluteURL');
+var combineURLs = require('./../helpers/combineURLs');
+
+/**
+ * Throws a `Cancel` if cancellation has been requested.
+ */
+function throwIfCancellationRequested(config) {
+  if (config.cancelToken) {
+    config.cancelToken.throwIfRequested();
+  }
+}
+
+/**
+ * Dispatch a request to the server using the configured adapter.
+ *
+ * @param {object} config The config that is to be used for the request
+ * @returns {Promise} The Promise to be fulfilled
+ */
+module.exports = function dispatchRequest(config) {
+  throwIfCancellationRequested(config);
+
+  // Support baseURL config
+  if (config.baseURL && !isAbsoluteURL(config.url)) {
+    config.url = combineURLs(config.baseURL, config.url);
+  }
+
+  // Ensure headers exist
+  config.headers = config.headers || {};
+
+  // Transform request data
+  config.data = transformData(
+    config.data,
+    config.headers,
+    config.transformRequest
+  );
+
+  // Flatten headers
+  config.headers = utils.merge(
+    config.headers.common || {},
+    config.headers[config.method] || {},
+    config.headers || {}
+  );
+
+  utils.forEach(
+    ['delete', 'get', 'head', 'post', 'put', 'patch', 'common'],
+    function cleanHeaderConfig(method) {
+      delete config.headers[method];
+    }
+  );
+
+  var adapter = config.adapter || defaults.adapter;
+
+  return adapter(config).then(function onAdapterResolution(response) {
+    throwIfCancellationRequested(config);
+
+    // Transform response data
+    response.data = transformData(
+      response.data,
+      response.headers,
+      config.transformResponse
+    );
+
+    return response;
+  }, function onAdapterRejection(reason) {
+    if (!isCancel(reason)) {
+      throwIfCancellationRequested(config);
+
+      // Transform response data
+      if (reason && reason.response) {
+        reason.response.data = transformData(
+          reason.response.data,
+          reason.response.headers,
+          config.transformResponse
+        );
+      }
+    }
+
+    return Promise.reject(reason);
+  });
+};

express-server/node_modules/axios/lib/core/enhanceError.js

@@ -0,0 +1,21 @@
+'use strict';
+
+/**
+ * Update an Error with the specified config, error code, and response.
+ *
+ * @param {Error} error The error to update.
+ * @param {Object} config The config.
+ * @param {string} [code] The error code (for example, 'ECONNABORTED').
+ * @param {Object} [request] The request.
+ * @param {Object} [response] The response.
+ * @returns {Error} The error.
+ */
+module.exports = function enhanceError(error, config, code, request, response) {
+  error.config = config;
+  if (code) {
+    error.code = code;
+  }
+  error.request = request;
+  error.response = response;
+  return error;
+};

express-server/node_modules/axios/lib/core/settle.js

@@ -0,0 +1,26 @@
+'use strict';
+
+var createError = require('./createError');
+
+/**
+ * Resolve or reject a Promise based on response status.
+ *
+ * @param {Function} resolve A function that resolves the promise.
+ * @param {Function} reject A function that rejects the promise.
+ * @param {object} response The response.
+ */
+module.exports = function settle(resolve, reject, response) {
+  var validateStatus = response.config.validateStatus;
+  // Note: status is not exposed by XDomainRequest
+  if (!response.status || !validateStatus || validateStatus(response.status)) {
+    resolve(response);
+  } else {
+    reject(createError(
+      'Request failed with status code ' + response.status,
+      response.config,
+      null,
+      response.request,
+      response
+    ));
+  }
+};

express-server/node_modules/axios/lib/core/transformData.js

@@ -0,0 +1,20 @@
+'use strict';
+
+var utils = require('./../utils');
+
+/**
+ * Transform the data for a request or a response
+ *
+ * @param {Object|String} data The data to be transformed
+ * @param {Array} headers The headers for the request or response
+ * @param {Array|Function} fns A single function or Array of functions
+ * @returns {*} The resulting transformed data
+ */
+module.exports = function transformData(data, headers, fns) {
+  /*eslint no-param-reassign:0*/
+  utils.forEach(fns, function transform(fn) {
+    data = fn(data, headers);
+  });
+
+  return data;
+};

express-server/node_modules/axios/lib/defaults.js

@@ -0,0 +1,96 @@
+'use strict';
+
+var utils = require('./utils');
+var normalizeHeaderName = require('./helpers/normalizeHeaderName');
+
+var DEFAULT_CONTENT_TYPE = {
+  'Content-Type': 'application/x-www-form-urlencoded'
+};
+
+function setContentTypeIfUnset(headers, value) {
+  if (!utils.isUndefined(headers) && utils.isUndefined(headers['Content-Type'])) {
+    headers['Content-Type'] = value;
+  }
+}
+
+function getDefaultAdapter() {
+  var adapter;
+  if (typeof XMLHttpRequest !== 'undefined') {
+    // For browsers use XHR adapter
+    adapter = require('./adapters/xhr');
+  } else if (typeof process !== 'undefined') {
+    // For node use HTTP adapter
+    adapter = require('./adapters/http');
+  }
+  return adapter;
+}
+
+var defaults = {
+  adapter: getDefaultAdapter(),
+
+  transformRequest: [function transformRequest(data, headers) {
+    normalizeHeaderName(headers, 'Content-Type');
+    if (utils.isFormData(data) ||
+      utils.isArrayBuffer(data) ||
+      utils.isBuffer(data) ||
+      utils.isStream(data) ||
+      utils.isFile(data) ||
+      utils.isBlob(data)
+    ) {
+      return data;
+    }
+    if (utils.isArrayBufferView(data)) {
+      return data.buffer;
+    }
+    if (utils.isURLSearchParams(data)) {
+      setContentTypeIfUnset(headers, 'application/x-www-form-urlencoded;charset=utf-8');
+      return data.toString();
+    }
+    if (utils.isObject(data)) {
+      setContentTypeIfUnset(headers, 'application/json;charset=utf-8');
+      return JSON.stringify(data);
+    }
+    return data;
+  }],
+
+  transformResponse: [function transformResponse(data) {
+    /*eslint no-param-reassign:0*/
+    if (typeof data === 'string') {
+      try {
+        data = JSON.parse(data);
+      } catch (e) { /* Ignore */ }
+    }
+    return data;
+  }],
+
+  /**
+   * A timeout in milliseconds to abort a request. If set to 0 (default) a
+   * timeout is not created.
+   */
+  timeout: 0,
+
+  xsrfCookieName: 'XSRF-TOKEN',
+  xsrfHeaderName: 'X-XSRF-TOKEN',
+
+  maxContentLength: -1,
+
+  validateStatus: function validateStatus(status) {
+    return status >= 200 && status < 300;
+  }
+};
+
+defaults.headers = {
+  common: {
+    'Accept': 'application/json, text/plain, */*'
+  }
+};
+
+utils.forEach(['delete', 'get', 'head'], function forEachMethodNoData(method) {
+  defaults.headers[method] = {};
+});
+
+utils.forEach(['post', 'put', 'patch'], function forEachMethodWithData(method) {
+  defaults.headers[method] = utils.merge(DEFAULT_CONTENT_TYPE);
+});
+
+module.exports = defaults;

express-server/node_modules/axios/lib/helpers/README.md

@@ -0,0 +1,7 @@
+# axios // helpers
+
+The modules found in `helpers/` should be generic modules that are _not_ specific to the domain logic of axios. These modules could theoretically be published to npm on their own and consumed by other modules or apps. Some examples of generic modules are things like:
+
+- Browser polyfills
+- Managing cookies
+- Parsing HTTP headers

express-server/node_modules/axios/lib/helpers/bind.js

@@ -0,0 +1,11 @@
+'use strict';
+
+module.exports = function bind(fn, thisArg) {
+  return function wrap() {
+    var args = new Array(arguments.length);
+    for (var i = 0; i < args.length; i++) {
+      args[i] = arguments[i];
+    }
+    return fn.apply(thisArg, args);
+  };
+};

express-server/node_modules/axios/lib/helpers/btoa.js

@@ -0,0 +1,36 @@
+'use strict';
+
+// btoa polyfill for IE<10 courtesy https://github.com/davidchambers/Base64.js
+
+var chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
+
+function E() {
+  this.message = 'String contains an invalid character';
+}
+E.prototype = new Error;
+E.prototype.code = 5;
+E.prototype.name = 'InvalidCharacterError';
+
+function btoa(input) {
+  var str = String(input);
+  var output = '';
+  for (
+    // initialize result and counter
+    var block, charCode, idx = 0, map = chars;
+    // if the next str index does not exist:
+    //   change the mapping table to "="
+    //   check if d has no fractional digits
+    str.charAt(idx | 0) || (map = '=', idx % 1);
+    // "8 - idx % 1 * 8" generates the sequence 2, 4, 6, 8
+    output += map.charAt(63 & block >> 8 - idx % 1 * 8)
+  ) {
+    charCode = str.charCodeAt(idx += 3 / 4);
+    if (charCode > 0xFF) {
+      throw new E();
+    }
+    block = block << 8 | charCode;
+  }
+  return output;
+}
+
+module.exports = btoa;

express-server/node_modules/axios/lib/helpers/buildURL.js

@@ -0,0 +1,66 @@
+'use strict';
+
+var utils = require('./../utils');
+
+function encode(val) {
+  return encodeURIComponent(val).
+    replace(/%40/gi, '@').
+    replace(/%3A/gi, ':').
+    replace(/%24/g, '$').
+    replace(/%2C/gi, ',').
+    replace(/%20/g, '+').
+    replace(/%5B/gi, '[').
+    replace(/%5D/gi, ']');
+}
+
+/**
+ * Build a URL by appending params to the end
+ *
+ * @param {string} url The base of the url (e.g., http://www.google.com)
+ * @param {object} [params] The params to be appended
+ * @returns {string} The formatted url
+ */
+module.exports = function buildURL(url, params, paramsSerializer) {
+  /*eslint no-param-reassign:0*/
+  if (!params) {
+    return url;
+  }
+
+  var serializedParams;
+  if (paramsSerializer) {
+    serializedParams = paramsSerializer(params);
+  } else if (utils.isURLSearchParams(params)) {
+    serializedParams = params.toString();
+  } else {
+    var parts = [];
+
+    utils.forEach(params, function serialize(val, key) {
+      if (val === null || typeof val === 'undefined') {
+        return;
+      }
+
+      if (utils.isArray(val)) {
+        key = key + '[]';
+      } else {
+        val = [val];
+      }
+
+      utils.forEach(val, function parseValue(v) {
+        if (utils.isDate(v)) {
+          v = v.toISOString();
+        } else if (utils.isObject(v)) {
+          v = JSON.stringify(v);
+        }
+        parts.push(encode(key) + '=' + encode(v));
+      });
+    });
+
+    serializedParams = parts.join('&');
+  }
+
+  if (serializedParams) {
+    url += (url.indexOf('?') === -1 ? '?' : '&') + serializedParams;
+  }
+
+  return url;
+};

express-server/node_modules/axios/lib/helpers/combineURLs.js

@@ -0,0 +1,14 @@
+'use strict';
+
+/**
+ * Creates a new URL by combining the specified URLs
+ *
+ * @param {string} baseURL The base URL
+ * @param {string} relativeURL The relative URL
+ * @returns {string} The combined URL
+ */
+module.exports = function combineURLs(baseURL, relativeURL) {
+  return relativeURL
+    ? baseURL.replace(/\/+$/, '') + '/' + relativeURL.replace(/^\/+/, '')
+    : baseURL;
+};

express-server/node_modules/axios/lib/helpers/cookies.js

@@ -0,0 +1,53 @@
+'use strict';
+
+var utils = require('./../utils');
+
+module.exports = (
+  utils.isStandardBrowserEnv() ?
+
+  // Standard browser envs support document.cookie
+  (function standardBrowserEnv() {
+    return {
+      write: function write(name, value, expires, path, domain, secure) {
+        var cookie = [];
+        cookie.push(name + '=' + encodeURIComponent(value));
+
+        if (utils.isNumber(expires)) {
+          cookie.push('expires=' + new Date(expires).toGMTString());
+        }
+
+        if (utils.isString(path)) {
+          cookie.push('path=' + path);
+        }
+
+        if (utils.isString(domain)) {
+          cookie.push('domain=' + domain);
+        }
+
+        if (secure === true) {
+          cookie.push('secure');
+        }
+
+        document.cookie = cookie.join('; ');
+      },
+
+      read: function read(name) {
+        var match = document.cookie.match(new RegExp('(^|;\\s*)(' + name + ')=([^;]*)'));
+        return (match ? decodeURIComponent(match[3]) : null);
+      },
+
+      remove: function remove(name) {
+        this.write(name, '', Date.now() - 86400000);
+      }
+    };
+  })() :
+
+  // Non standard browser env (web workers, react-native) lack needed support.
+  (function nonStandardBrowserEnv() {
+    return {
+      write: function write() {},
+      read: function read() { return null; },
+      remove: function remove() {}
+    };
+  })()
+);

express-server/node_modules/axios/lib/helpers/deprecatedMethod.js

@@ -0,0 +1,24 @@
+'use strict';
+
+/*eslint no-console:0*/
+
+/**
+ * Supply a warning to the developer that a method they are using
+ * has been deprecated.
+ *
+ * @param {string} method The name of the deprecated method
+ * @param {string} [instead] The alternate method to use if applicable
+ * @param {string} [docs] The documentation URL to get further details
+ */
+module.exports = function deprecatedMethod(method, instead, docs) {
+  try {
+    console.warn(
+      'DEPRECATED method `' + method + '`.' +
+      (instead ? ' Use `' + instead + '` instead.' : '') +
+      ' This method will be removed in a future release.');
+
+    if (docs) {
+      console.warn('For more information about usage see ' + docs);
+    }
+  } catch (e) { /* Ignore */ }
+};

express-server/node_modules/axios/lib/helpers/isAbsoluteURL.js

@@ -0,0 +1,14 @@
+'use strict';
+
+/**
+ * Determines whether the specified URL is absolute
+ *
+ * @param {string} url The URL to test
+ * @returns {boolean} True if the specified URL is absolute, otherwise false
+ */
+module.exports = function isAbsoluteURL(url) {
+  // A URL is considered absolute if it begins with "<scheme>://" or "//" (protocol-relative URL).
+  // RFC 3986 defines scheme name as a sequence of characters beginning with a letter and followed
+  // by any combination of letters, digits, plus, period, or hyphen.
+  return /^([a-z][a-z\d\+\-\.]*:)?\/\//i.test(url);
+};

express-server/node_modules/axios/lib/helpers/isURLSameOrigin.js

@@ -0,0 +1,68 @@
+'use strict';
+
+var utils = require('./../utils');
+
+module.exports = (
+  utils.isStandardBrowserEnv() ?
+
+  // Standard browser envs have full support of the APIs needed to test
+  // whether the request URL is of the same origin as current location.
+  (function standardBrowserEnv() {
+    var msie = /(msie|trident)/i.test(navigator.userAgent);
+    var urlParsingNode = document.createElement('a');
+    var originURL;
+
+    /**
+    * Parse a URL to discover it's components
+    *
+    * @param {String} url The URL to be parsed
+    * @returns {Object}
+    */
+    function resolveURL(url) {
+      var href = url;
+
+      if (msie) {
+        // IE needs attribute set twice to normalize properties
+        urlParsingNode.setAttribute('href', href);
+        href = urlParsingNode.href;
+      }
+
+      urlParsingNode.setAttribute('href', href);
+
+      // urlParsingNode provides the UrlUtils interface - http://url.spec.whatwg.org/#urlutils
+      return {
+        href: urlParsingNode.href,
+        protocol: urlParsingNode.protocol ? urlParsingNode.protocol.replace(/:$/, '') : '',
+        host: urlParsingNode.host,
+        search: urlParsingNode.search ? urlParsingNode.search.replace(/^\?/, '') : '',
+        hash: urlParsingNode.hash ? urlParsingNode.hash.replace(/^#/, '') : '',
+        hostname: urlParsingNode.hostname,
+        port: urlParsingNode.port,
+        pathname: (urlParsingNode.pathname.charAt(0) === '/') ?
+                  urlParsingNode.pathname :
+                  '/' + urlParsingNode.pathname
+      };
+    }
+
+    originURL = resolveURL(window.location.href);
+
+    /**
+    * Determine if a URL shares the same origin as the current location
+    *
+    * @param {String} requestURL The URL to test
+    * @returns {boolean} True if URL shares the same origin, otherwise false
+    */
+    return function isURLSameOrigin(requestURL) {
+      var parsed = (utils.isString(requestURL)) ? resolveURL(requestURL) : requestURL;
+      return (parsed.protocol === originURL.protocol &&
+            parsed.host === originURL.host);
+    };
+  })() :
+
+  // Non standard browser envs (web workers, react-native) lack needed support.
+  (function nonStandardBrowserEnv() {
+    return function isURLSameOrigin() {
+      return true;
+    };
+  })()
+);

express-server/node_modules/axios/lib/helpers/normalizeHeaderName.js

@@ -0,0 +1,12 @@
+'use strict';
+
+var utils = require('../utils');
+
+module.exports = function normalizeHeaderName(headers, normalizedName) {
+  utils.forEach(headers, function processHeader(value, name) {
+    if (name !== normalizedName && name.toUpperCase() === normalizedName.toUpperCase()) {
+      headers[normalizedName] = value;
+      delete headers[name];
+    }
+  });
+};

express-server/node_modules/axios/lib/helpers/parseHeaders.js

@@ -0,0 +1,53 @@
+'use strict';
+
+var utils = require('./../utils');
+
+// Headers whose duplicates are ignored by node
+// c.f. https://nodejs.org/api/http.html#http_message_headers
+var ignoreDuplicateOf = [
+  'age', 'authorization', 'content-length', 'content-type', 'etag',
+  'expires', 'from', 'host', 'if-modified-since', 'if-unmodified-since',
+  'last-modified', 'location', 'max-forwards', 'proxy-authorization',
+  'referer', 'retry-after', 'user-agent'
+];
+
+/**
+ * Parse headers into an object
+ *
+ * ```
+ * Date: Wed, 27 Aug 2014 08:58:49 GMT
+ * Content-Type: application/json
+ * Connection: keep-alive
+ * Transfer-Encoding: chunked
+ * ```
+ *
+ * @param {String} headers Headers needing to be parsed
+ * @returns {Object} Headers parsed into an object
+ */
+module.exports = function parseHeaders(headers) {
+  var parsed = {};
+  var key;
+  var val;
+  var i;
+
+  if (!headers) { return parsed; }
+
+  utils.forEach(headers.split('\n'), function parser(line) {
+    i = line.indexOf(':');
+    key = utils.trim(line.substr(0, i)).toLowerCase();
+    val = utils.trim(line.substr(i + 1));
+
+    if (key) {
+      if (parsed[key] && ignoreDuplicateOf.indexOf(key) >= 0) {
+        return;
+      }
+      if (key === 'set-cookie') {
+        parsed[key] = (parsed[key] ? parsed[key] : []).concat([val]);
+      } else {
+        parsed[key] = parsed[key] ? parsed[key] + ', ' + val : val;
+      }
+    }
+  });
+
+  return parsed;
+};

express-server/node_modules/axios/lib/helpers/spread.js

@@ -0,0 +1,27 @@
+'use strict';
+
+/**
+ * Syntactic sugar for invoking a function and expanding an array for arguments.
+ *
+ * Common use case would be to use `Function.prototype.apply`.
+ *
+ *  ```js
+ *  function f(x, y, z) {}
+ *  var args = [1, 2, 3];
+ *  f.apply(null, args);
+ *  ```
+ *
+ * With `spread` this example can be re-written.
+ *
+ *  ```js
+ *  spread(function(x, y, z) {})([1, 2, 3]);
+ *  ```
+ *
+ * @param {Function} callback
+ * @returns {Function}
+ */
+module.exports = function spread(callback) {
+  return function wrap(arr) {
+    return callback.apply(null, arr);
+  };
+};

express-server/node_modules/axios/lib/utils.js

@@ -0,0 +1,303 @@
+'use strict';
+
+var bind = require('./helpers/bind');
+var isBuffer = require('is-buffer');
+
+/*global toString:true*/
+
+// utils is a library of generic helper functions non-specific to axios
+
+var toString = Object.prototype.toString;
+
+/**
+ * Determine if a value is an Array
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is an Array, otherwise false
+ */
+function isArray(val) {
+  return toString.call(val) === '[object Array]';
+}
+
+/**
+ * Determine if a value is an ArrayBuffer
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is an ArrayBuffer, otherwise false
+ */
+function isArrayBuffer(val) {
+  return toString.call(val) === '[object ArrayBuffer]';
+}
+
+/**
+ * Determine if a value is a FormData
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is an FormData, otherwise false
+ */
+function isFormData(val) {
+  return (typeof FormData !== 'undefined') && (val instanceof FormData);
+}
+
+/**
+ * Determine if a value is a view on an ArrayBuffer
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a view on an ArrayBuffer, otherwise false
+ */
+function isArrayBufferView(val) {
+  var result;
+  if ((typeof ArrayBuffer !== 'undefined') && (ArrayBuffer.isView)) {
+    result = ArrayBuffer.isView(val);
+  } else {
+    result = (val) && (val.buffer) && (val.buffer instanceof ArrayBuffer);
+  }
+  return result;
+}
+
+/**
+ * Determine if a value is a String
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a String, otherwise false
+ */
+function isString(val) {
+  return typeof val === 'string';
+}
+
+/**
+ * Determine if a value is a Number
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a Number, otherwise false
+ */
+function isNumber(val) {
+  return typeof val === 'number';
+}
+
+/**
+ * Determine if a value is undefined
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if the value is undefined, otherwise false
+ */
+function isUndefined(val) {
+  return typeof val === 'undefined';
+}
+
+/**
+ * Determine if a value is an Object
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is an Object, otherwise false
+ */
+function isObject(val) {
+  return val !== null && typeof val === 'object';
+}
+
+/**
+ * Determine if a value is a Date
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a Date, otherwise false
+ */
+function isDate(val) {
+  return toString.call(val) === '[object Date]';
+}
+
+/**
+ * Determine if a value is a File
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a File, otherwise false
+ */
+function isFile(val) {
+  return toString.call(val) === '[object File]';
+}
+
+/**
+ * Determine if a value is a Blob
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a Blob, otherwise false
+ */
+function isBlob(val) {
+  return toString.call(val) === '[object Blob]';
+}
+
+/**
+ * Determine if a value is a Function
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a Function, otherwise false
+ */
+function isFunction(val) {
+  return toString.call(val) === '[object Function]';
+}
+
+/**
+ * Determine if a value is a Stream
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a Stream, otherwise false
+ */
+function isStream(val) {
+  return isObject(val) && isFunction(val.pipe);
+}
+
+/**
+ * Determine if a value is a URLSearchParams object
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a URLSearchParams object, otherwise false
+ */
+function isURLSearchParams(val) {
+  return typeof URLSearchParams !== 'undefined' && val instanceof URLSearchParams;
+}
+
+/**
+ * Trim excess whitespace off the beginning and end of a string
+ *
+ * @param {String} str The String to trim
+ * @returns {String} The String freed of excess whitespace
+ */
+function trim(str) {
+  return str.replace(/^\s*/, '').replace(/\s*$/, '');
+}
+
+/**
+ * Determine if we're running in a standard browser environment
+ *
+ * This allows axios to run in a web worker, and react-native.
+ * Both environments support XMLHttpRequest, but not fully standard globals.
+ *
+ * web workers:
+ *  typeof window -> undefined
+ *  typeof document -> undefined
+ *
+ * react-native:
+ *  navigator.product -> 'ReactNative'
+ */
+function isStandardBrowserEnv() {
+  if (typeof navigator !== 'undefined' && navigator.product === 'ReactNative') {
+    return false;
+  }
+  return (
+    typeof window !== 'undefined' &&
+    typeof document !== 'undefined'
+  );
+}
+
+/**
+ * Iterate over an Array or an Object invoking a function for each item.
+ *
+ * If `obj` is an Array callback will be called passing
+ * the value, index, and complete array for each item.
+ *
+ * If 'obj' is an Object callback will be called passing
+ * the value, key, and complete object for each property.
+ *
+ * @param {Object|Array} obj The object to iterate
+ * @param {Function} fn The callback to invoke for each item
+ */
+function forEach(obj, fn) {
+  // Don't bother if no value provided
+  if (obj === null || typeof obj === 'undefined') {
+    return;
+  }
+
+  // Force an array if not already something iterable
+  if (typeof obj !== 'object') {
+    /*eslint no-param-reassign:0*/
+    obj = [obj];
+  }
+
+  if (isArray(obj)) {
+    // Iterate over array values
+    for (var i = 0, l = obj.length; i < l; i++) {
+      fn.call(null, obj[i], i, obj);
+    }
+  } else {
+    // Iterate over object keys
+    for (var key in obj) {
+      if (Object.prototype.hasOwnProperty.call(obj, key)) {
+        fn.call(null, obj[key], key, obj);
+      }
+    }
+  }
+}
+
+/**
+ * Accepts varargs expecting each argument to be an object, then
+ * immutably merges the properties of each object and returns result.
+ *
+ * When multiple objects contain the same key the later object in
+ * the arguments list will take precedence.
+ *
+ * Example:
+ *
+ * ```js
+ * var result = merge({foo: 123}, {foo: 456});
+ * console.log(result.foo); // outputs 456
+ * ```
+ *
+ * @param {Object} obj1 Object to merge
+ * @returns {Object} Result of all merge properties
+ */
+function merge(/* obj1, obj2, obj3, ... */) {
+  var result = {};
+  function assignValue(val, key) {
+    if (typeof result[key] === 'object' && typeof val === 'object') {
+      result[key] = merge(result[key], val);
+    } else {
+      result[key] = val;
+    }
+  }
+
+  for (var i = 0, l = arguments.length; i < l; i++) {
+    forEach(arguments[i], assignValue);
+  }
+  return result;
+}
+
+/**
+ * Extends object a by mutably adding to it the properties of object b.
+ *
+ * @param {Object} a The object to be extended
+ * @param {Object} b The object to copy properties from
+ * @param {Object} thisArg The object to bind function to
+ * @return {Object} The resulting value of object a
+ */
+function extend(a, b, thisArg) {
+  forEach(b, function assignValue(val, key) {
+    if (thisArg && typeof val === 'function') {
+      a[key] = bind(val, thisArg);
+    } else {
+      a[key] = val;
+    }
+  });
+  return a;
+}
+
+module.exports = {
+  isArray: isArray,
+  isArrayBuffer: isArrayBuffer,
+  isBuffer: isBuffer,
+  isFormData: isFormData,
+  isArrayBufferView: isArrayBufferView,
+  isString: isString,
+  isNumber: isNumber,
+  isObject: isObject,
+  isUndefined: isUndefined,
+  isDate: isDate,
+  isFile: isFile,
+  isBlob: isBlob,
+  isFunction: isFunction,
+  isStream: isStream,
+  isURLSearchParams: isURLSearchParams,
+  isStandardBrowserEnv: isStandardBrowserEnv,
+  forEach: forEach,
+  merge: merge,
+  extend: extend,
+  trim: trim
+};

express-server/node_modules/axios/package.json

@@ -0,0 +1,113 @@
+{
+  "_from": "axios@^0.18.0",
+  "_id": "axios@0.18.0",
+  "_inBundle": false,
+  "_integrity": "sha1-MtU+SFHv3AoRmTts0AB4nXDAUQI=",
+  "_location": "/axios",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "range",
+    "registry": true,
+    "raw": "axios@^0.18.0",
+    "name": "axios",
+    "escapedName": "axios",
+    "rawSpec": "^0.18.0",
+    "saveSpec": null,
+    "fetchSpec": "^0.18.0"
+  },
+  "_requiredBy": [
+    "/gcp-metadata",
+    "/google-auth-library",
+    "/googleapis-common",
+    "/gtoken"
+  ],
+  "_resolved": "http://registry.npmjs.org/axios/-/axios-0.18.0.tgz",
+  "_shasum": "32d53e4851efdc0a11993b6cd000789d70c05102",
+  "_spec": "axios@^0.18.0",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\google-auth-library",
+  "author": {
+    "name": "Matt Zabriskie"
+  },
+  "browser": {
+    "./lib/adapters/http.js": "./lib/adapters/xhr.js"
+  },
+  "bugs": {
+    "url": "https://github.com/axios/axios/issues"
+  },
+  "bundleDependencies": false,
+  "bundlesize": [
+    {
+      "path": "./dist/axios.min.js",
+      "threshold": "5kB"
+    }
+  ],
+  "dependencies": {
+    "follow-redirects": "^1.3.0",
+    "is-buffer": "^1.1.5"
+  },
+  "deprecated": false,
+  "description": "Promise based HTTP client for the browser and node.js",
+  "devDependencies": {
+    "bundlesize": "^0.5.7",
+    "coveralls": "^2.11.9",
+    "es6-promise": "^4.0.5",
+    "grunt": "^1.0.1",
+    "grunt-banner": "^0.6.0",
+    "grunt-cli": "^1.2.0",
+    "grunt-contrib-clean": "^1.0.0",
+    "grunt-contrib-nodeunit": "^1.0.0",
+    "grunt-contrib-watch": "^1.0.0",
+    "grunt-eslint": "^19.0.0",
+    "grunt-karma": "^2.0.0",
+    "grunt-ts": "^6.0.0-beta.3",
+    "grunt-webpack": "^1.0.18",
+    "istanbul-instrumenter-loader": "^1.0.0",
+    "jasmine-core": "^2.4.1",
+    "karma": "^1.3.0",
+    "karma-chrome-launcher": "^2.0.0",
+    "karma-coverage": "^1.0.0",
+    "karma-firefox-launcher": "^1.0.0",
+    "karma-jasmine": "^1.0.2",
+    "karma-jasmine-ajax": "^0.1.13",
+    "karma-opera-launcher": "^1.0.0",
+    "karma-safari-launcher": "^1.0.0",
+    "karma-sauce-launcher": "^1.1.0",
+    "karma-sinon": "^1.0.5",
+    "karma-sourcemap-loader": "^0.3.7",
+    "karma-webpack": "^1.7.0",
+    "load-grunt-tasks": "^3.5.2",
+    "minimist": "^1.2.0",
+    "sinon": "^1.17.4",
+    "typescript": "^2.0.3",
+    "url-search-params": "^0.6.1",
+    "webpack": "^1.13.1",
+    "webpack-dev-server": "^1.14.1"
+  },
+  "homepage": "https://github.com/axios/axios",
+  "keywords": [
+    "xhr",
+    "http",
+    "ajax",
+    "promise",
+    "node"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "name": "axios",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/axios/axios.git"
+  },
+  "scripts": {
+    "build": "NODE_ENV=production grunt build",
+    "coveralls": "cat coverage/lcov.info | ./node_modules/coveralls/bin/coveralls.js",
+    "examples": "node ./examples/server.js",
+    "postversion": "git push && git push --tags",
+    "preversion": "npm test",
+    "start": "node ./sandbox/server.js",
+    "test": "grunt test && bundlesize",
+    "version": "npm run build && grunt version && git add -A dist && git add CHANGELOG.md bower.json package.json"
+  },
+  "typings": "./index.d.ts",
+  "version": "0.18.0"
+}

express-server/node_modules/buffer-equal-constant-time/.npmignore

@@ -0,0 +1,2 @@
+.*.sw[mnop]
+node_modules/

express-server/node_modules/buffer-equal-constant-time/.travis.yml

@@ -0,0 +1,4 @@
+language: node_js
+node_js:
+- "0.11"
+- "0.10"

express-server/node_modules/buffer-equal-constant-time/LICENSE.txt

@@ -0,0 +1,12 @@
+Copyright (c) 2013, GoInstant Inc., a salesforce.com company
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+* Neither the name of salesforce.com, nor GoInstant, nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

express-server/node_modules/buffer-equal-constant-time/README.md

@@ -0,0 +1,50 @@
+# buffer-equal-constant-time
+
+Constant-time `Buffer` comparison for node.js.  Should work with browserify too.
+
+[![Build Status](https://travis-ci.org/goinstant/buffer-equal-constant-time.png?branch=master)](https://travis-ci.org/goinstant/buffer-equal-constant-time)
+
+```sh
+  npm install buffer-equal-constant-time
+```
+
+# Usage
+
+```js
+  var bufferEq = require('buffer-equal-constant-time');
+
+  var a = new Buffer('asdf');
+  var b = new Buffer('asdf');
+  if (bufferEq(a,b)) {
+    // the same!
+  } else {
+    // different in at least one byte!
+  }
+```
+
+If you'd like to install an `.equal()` method onto the node.js `Buffer` and
+`SlowBuffer` prototypes:
+
+```js
+  require('buffer-equal-constant-time').install();
+
+  var a = new Buffer('asdf');
+  var b = new Buffer('asdf');
+  if (a.equal(b)) {
+    // the same!
+  } else {
+    // different in at least one byte!
+  }
+```
+
+To get rid of the installed `.equal()` method, call `.restore()`:
+
+```js
+  require('buffer-equal-constant-time').restore();
+```
+
+# Legal
+
+© 2013 GoInstant Inc., a salesforce.com company
+
+Licensed under the BSD 3-clause license.

express-server/node_modules/buffer-equal-constant-time/index.js

@@ -0,0 +1,41 @@
+/*jshint node:true */
+'use strict';
+var Buffer = require('buffer').Buffer; // browserify
+var SlowBuffer = require('buffer').SlowBuffer;
+
+module.exports = bufferEq;
+
+function bufferEq(a, b) {
+
+  // shortcutting on type is necessary for correctness
+  if (!Buffer.isBuffer(a) || !Buffer.isBuffer(b)) {
+    return false;
+  }
+
+  // buffer sizes should be well-known information, so despite this
+  // shortcutting, it doesn't leak any information about the *contents* of the
+  // buffers.
+  if (a.length !== b.length) {
+    return false;
+  }
+
+  var c = 0;
+  for (var i = 0; i < a.length; i++) {
+    /*jshint bitwise:false */
+    c |= a[i] ^ b[i]; // XOR
+  }
+  return c === 0;
+}
+
+bufferEq.install = function() {
+  Buffer.prototype.equal = SlowBuffer.prototype.equal = function equal(that) {
+    return bufferEq(this, that);
+  };
+};
+
+var origBufEqual = Buffer.prototype.equal;
+var origSlowBufEqual = SlowBuffer.prototype.equal;
+bufferEq.restore = function() {
+  Buffer.prototype.equal = origBufEqual;
+  SlowBuffer.prototype.equal = origSlowBufEqual;
+};

express-server/node_modules/buffer-equal-constant-time/package.json

@@ -0,0 +1,55 @@
+{
+  "_from": "buffer-equal-constant-time@1.0.1",
+  "_id": "buffer-equal-constant-time@1.0.1",
+  "_inBundle": false,
+  "_integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk=",
+  "_location": "/buffer-equal-constant-time",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "buffer-equal-constant-time@1.0.1",
+    "name": "buffer-equal-constant-time",
+    "escapedName": "buffer-equal-constant-time",
+    "rawSpec": "1.0.1",
+    "saveSpec": null,
+    "fetchSpec": "1.0.1"
+  },
+  "_requiredBy": [
+    "/jwa"
+  ],
+  "_resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
+  "_shasum": "f8e71132f7ffe6e01a5c9697a4c6f3e48d5cc819",
+  "_spec": "buffer-equal-constant-time@1.0.1",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\jwa",
+  "author": {
+    "name": "GoInstant Inc., a salesforce.com company"
+  },
+  "bugs": {
+    "url": "https://github.com/goinstant/buffer-equal-constant-time/issues"
+  },
+  "bundleDependencies": false,
+  "deprecated": false,
+  "description": "Constant-time comparison of Buffers",
+  "devDependencies": {
+    "mocha": "~1.15.1"
+  },
+  "homepage": "https://github.com/goinstant/buffer-equal-constant-time#readme",
+  "keywords": [
+    "buffer",
+    "equal",
+    "constant-time",
+    "crypto"
+  ],
+  "license": "BSD-3-Clause",
+  "main": "index.js",
+  "name": "buffer-equal-constant-time",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/goinstant/buffer-equal-constant-time.git"
+  },
+  "scripts": {
+    "test": "mocha test.js"
+  },
+  "version": "1.0.1"
+}

express-server/node_modules/buffer-equal-constant-time/test.js

@@ -0,0 +1,42 @@
+/*jshint node:true */
+'use strict';
+
+var bufferEq = require('./index');
+var assert = require('assert');
+
+describe('buffer-equal-constant-time', function() {
+  var a = new Buffer('asdfasdf123456');
+  var b = new Buffer('asdfasdf123456');
+  var c = new Buffer('asdfasdf');
+
+  describe('bufferEq', function() {
+    it('says a == b', function() {
+      assert.strictEqual(bufferEq(a, b), true);
+    });
+
+    it('says a != c', function() {
+      assert.strictEqual(bufferEq(a, c), false);
+    });
+  });
+
+  describe('install/restore', function() {
+    before(function() {
+      bufferEq.install();
+    });
+    after(function() {
+      bufferEq.restore();
+    });
+
+    it('installed an .equal method', function() {
+      var SlowBuffer = require('buffer').SlowBuffer;
+      assert.ok(Buffer.prototype.equal);
+      assert.ok(SlowBuffer.prototype.equal);
+    });
+
+    it('infected existing Buffers', function() {
+      assert.strictEqual(a.equal(b), true);
+      assert.strictEqual(a.equal(c), false);
+    });
+  });
+
+});

express-server/node_modules/cookie-session/HISTORY.md

@@ -0,0 +1,129 @@
+2.0.0-beta.3 / 2017-10-13
+=========================
+
+  * deps: cookies@0.7.1
+    - deps: depd@~1.1.1
+    - deps: keygrip@~1.0.2
+  * deps: debug@3.1.0
+    - Add `DEBUG_HIDE_DATE`
+    - Add 256 color mode support
+    - Enable / disable namespaces dynamically
+    - Make millisecond timer namespace-specific
+    - Remove `DEBUG_FD` support
+    - Use `Date#toISOString()` when output is not a TTY
+  * deps: safe-buffer@5.1.1
+
+2.0.0-beta.2 / 2017-05-23
+=========================
+
+  * Create new session for all types of invalid sessions
+  * Use `safe-buffer` for improved Buffer API
+  * deps: debug@2.6.8
+    - Fix `DEBUG_MAX_ARRAY_LENGTH`
+    - deps: ms@2.0.0
+
+2.0.0-beta.1 / 2017-02-19
+==========================
+
+  * Drop support for Node.js 0.8
+  * deps: cookies@0.7.0
+    - Add `sameSite` option for SameSite cookie support
+    - pref: enable strict mode
+
+2.0.0-alpha.3 / 2017-02-12
+==========================
+
+  * Use `Object.defineProperty` instead of deprecated `__define*__`
+  * deps: cookies@0.6.2
+    - deps: keygrip@~1.0.1
+  * deps: debug@2.6.1
+    - Allow colors in workers
+    - Deprecated `DEBUG_FD` environment variable set to `3` or higher
+    - Fix error when running under React Native
+    - Use same color for same namespace
+    - deps: ms@0.7.2
+
+2.0.0-alpha.2 / 2016-11-10
+==========================
+
+  * deps: cookies@0.6.1
+  * deps: debug@2.3.2
+    - Fix error when running under React Native
+    - deps: ms@0.7.2
+
+2.0.0-alpha.1 / 2015-10-11
+==========================
+
+  * Change default cookie name to `session`
+  * Change `.populated` to `.isPopulated`
+  * Remove the `key` option; use `name` instead
+  * Save all enumerable properties on `req.session`
+    - Including `_`-prefixed properties
+  * perf: reduce the scope of try-catch deopt
+  * deps: cookies@0.5.1
+    - Throw on invalid values provided to `Cookie` constructor
+  * deps: on-headers@~1.0.1
+    - perf: enable strict mode
+
+1.3.2 / 2017-09-24
+==================
+
+  * deps: debug@2.6.9
+
+1.3.1 / 2017-08-27
+==================
+
+  * deps: cookies@0.7.1
+    - deps: depd@~1.1.1
+    - deps: keygrip@~1.0.2
+
+1.3.0 / 2017-08-03
+==================
+
+  * deps: cookies@0.7.0
+    - Add `sameSite` option for SameSite cookie support
+    - Throw on invalid values provided to `Cookie` constructor
+    - deps: keygrip@~1.0.1
+    - pref: enable strict mode
+  * deps: debug@2.6.8
+    - Allow colors in workers
+    - Deprecate `DEBUG_FD` environment variable set to 3 or higher
+    - Fix error when running under React Native
+    - Use same color for same namespace
+    - deps: ms@2.0.0
+  * deps: on-headers@~1.0.1
+    - perf: enable strict mode
+
+1.2.0 / 2015-07-01
+==================
+
+  * Make `isNew` non-enumerable and non-writeable
+  * Make `req.sessionOptions` a shallow clone to override per-request
+  * deps: debug@~2.2.0
+    - Fix high intensity foreground color for bold
+    - deps: ms@0.7.0
+  * perf: enable strict mode
+  * perf: remove argument reassignments
+
+1.1.0 / 2014-11-09
+==================
+
+  * Fix errors setting cookies to be non-fatal
+  * Use `on-headers` instead of `writeHead` patching
+  * deps: cookies@0.5.0
+  * deps: debug@~2.1.0
+
+1.0.2 / 2014-05-07
+==================
+
+  * Add `name` option
+
+1.0.1 / 2014-02-24
+==================
+
+  * Fix duplicate `dependencies` in `package.json`
+
+1.0.0 / 2014-02-23
+==================
+
+  * Initial release

express-server/node_modules/cookie-session/LICENSE

@@ -0,0 +1,23 @@
+(The MIT License)
+
+Copyright (c) 2013 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2014-2017 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

express-server/node_modules/cookie-session/README.md

@@ -0,0 +1,252 @@
+# cookie-session
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+[![Gratipay][gratipay-image]][gratipay-url]
+
+Simple cookie-based session middleware.
+
+A user session can be stored in two main ways with cookies: on the server or on
+the client. This module stores the session data on the client within a cookie,
+while a module like [express-session](https://www.npmjs.com/package/express-session)
+stores only a session identifier on the client within a cookie and stores the
+session data on the server, typically in a database.
+
+The following points can help you choose which to use:
+
+  * `cookie-session` does not require any database / resources on the server side,
+    though the total session data cannot exceed the browser's max cookie size.
+  * `cookie-session` can simplify certain load-balanced scenarios.
+  * `cookie-session` can be used to store a "light" session and include an identifier
+    to look up a database-backed secondary store to reduce database lookups.
+
+## Install
+
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/). Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
+```sh
+$ npm install cookie-session
+```
+
+## API
+
+```js
+var cookieSession = require('cookie-session')
+var express = require('express')
+
+var app = express()
+
+app.use(cookieSession({
+  name: 'session',
+  keys: [/* secret keys */],
+
+  // Cookie Options
+  maxAge: 24 * 60 * 60 * 1000 // 24 hours
+}))
+```
+
+### cookieSession(options)
+
+Create a new cookie session middleware with the provided options. This middleware
+will attach the property `session` to `req`, which provides an object representing
+the loaded session. This session is either a new session if no valid session was
+provided in the request, or a loaded session from the request.
+
+The middleware will automatically add a `Set-Cookie` header to the response if the
+contents of `req.session` were altered. _Note_ that no `Set-Cookie` header will be
+in the response (and thus no session created for a specific user) unless there are
+contents in the session, so be sure to add something to `req.session` as soon as
+you have identifying information to store for the session.
+
+#### Options
+
+Cookie session accepts these properties in the options object.
+
+##### name
+
+The name of the cookie to set, defaults to `session`.
+
+##### keys
+
+The list of keys to use to sign & verify cookie values. Set cookies are always
+signed with `keys[0]`, while the other keys are valid for verification, allowing
+for key rotation.
+
+##### secret
+
+A string which will be used as single key if `keys` is not provided.
+
+##### Cookie Options
+
+Other options are passed to `cookies.get()` and `cookies.set()` allowing you
+to control security, domain, path, and signing among other settings.
+
+The options can also contain any of the following (for the full list, see
+[cookies module documentation](https://www.npmjs.org/package/cookies#readme):
+
+  - `maxAge`: a number representing the milliseconds from `Date.now()` for expiry
+  - `expires`: a `Date` object indicating the cookie's expiration date (expires at the end of session by default).
+  - `path`: a string indicating the path of the cookie (`/` by default).
+  - `domain`: a string indicating the domain of the cookie (no default).
+  - `sameSite`: a boolean or string indicating whether the cookie is a "same site" cookie (`false` by default). This can be set to `'strict'`, `'lax'`, or `true` (which maps to `'strict'`).
+  - `secure`: a boolean indicating whether the cookie is only to be sent over HTTPS (`false` by default for HTTP, `true` by default for HTTPS). If this is set to `true` and Node.js is not directly over a TLS connection, be sure to read how to [setup Express behind proxies](https://expressjs.com/en/guide/behind-proxies.html) or the cookie may not ever set correctly.
+  - `httpOnly`: a boolean indicating whether the cookie is only to be sent over HTTP(S), and not made available to client JavaScript (`true` by default).
+  - `signed`: a boolean indicating whether the cookie is to be signed (`true` by default). If this is true, another cookie of the same name with the `.sig` suffix appended will also be sent, with a 27-byte url-safe base64 SHA1 value representing the hash of _cookie-name_=_cookie-value_ against the first [Keygrip](https://github.com/expressjs/keygrip) key. This signature key is used to detect tampering the next time a cookie is received.
+  - `overwrite`: a boolean indicating whether to overwrite previously set cookies of the same name (`true` by default). If this is true, all cookies set during the same request with the same name (regardless of path or domain) are filtered out of the Set-Cookie header when setting this cookie.
+
+### req.session
+
+Represents the session for the given request.
+
+#### .isChanged
+
+Is `true` if the session has been changed during the request.
+
+#### .isNew
+
+Is `true` if the session is new.
+
+#### .isPopulated
+
+Determine if the session has been populated with data or is empty.
+
+### req.sessionOptions
+
+Represents the session options for the current request. These options are a
+shallow clone of what was provided at middleware construction and can be
+altered to change cookie setting behavior on a per-request basis.
+
+### Destroying a session
+
+To destroy a session simply set it to `null`:
+
+```
+req.session = null
+```
+
+## Examples
+
+### Simple view counter example
+
+```js
+var cookieSession = require('cookie-session')
+var express = require('express')
+
+var app = express()
+
+app.set('trust proxy', 1) // trust first proxy
+
+app.use(cookieSession({
+  name: 'session',
+  keys: ['key1', 'key2']
+}))
+
+app.get('/', function (req, res, next) {
+  // Update views
+  req.session.views = (req.session.views || 0) + 1
+
+  // Write response
+  res.end(req.session.views + ' views')
+})
+
+app.listen(3000)
+```
+
+### Per-user sticky max age
+
+```js
+var cookieSession = require('cookie-session')
+var express = require('express')
+
+var app = express()
+
+app.set('trust proxy', 1) // trust first proxy
+
+app.use(cookieSession({
+  name: 'session',
+  keys: ['key1', 'key2']
+}))
+
+// This allows you to set req.session.maxAge to let certain sessions
+// have a different value than the default.
+app.use(function (req, res, next) {
+  req.sessionOptions.maxAge = req.session.maxAge || req.sessionOptions.maxAge
+  next()
+})
+
+// ... your logic here ...
+```
+
+### Extending the session expiration
+
+This module does not send a `Set-Cookie` header if the contents of the session
+have not changed. This means that to extend the expiration of a session in the
+user's browser (in response to user activity, for example) some kind of
+modification to the session needs be made.
+
+```js
+var cookieSession = require('cookie-session')
+var express = require('express')
+
+var app = express()
+
+app.use(cookieSession({
+  name: 'session',
+  keys: ['key1', 'key2']
+}))
+
+// Update a value in the cookie so that the set-cookie will be sent.
+// Only changes every minute so that it's not sent with every request.
+app.use(function (req, res, next) {
+  req.session.nowInMinutes = Math.floor(Date.now() / 60e3)
+  next()
+})
+
+// ... your logic here ...
+```
+
+## Usage Limitations
+
+### Max Cookie Size
+
+Because the entire session object is encoded and stored in a cookie, it is
+possible to exceed the maxium cookie size limits on different browsers. The
+[RFC6265 specification](https://tools.ietf.org/html/rfc6265#section-6.1)
+recommends that a browser **SHOULD** allow
+
+> At least 4096 bytes per cookie (as measured by the sum of the length of
+> the cookie's name, value, and attributes)
+
+In practice this limit differs slightly across browsers. See a list of
+[browser limits here](http://browsercookielimits.squawky.net/). As a rule
+of thumb **don't exceed 4093 bytes per domain**.
+
+If your session object is large enough to exceed a browser limit when encoded,
+in most cases the browser will refuse to store the cookie. This will cause the
+following requests from the browser to either a) not have any session
+information or b) use old session information that was small enough to not
+exceed the cookie limit.
+
+If you find your session object is hitting these limits, it is best to
+consider if  data in your session should be loaded from a database on the
+server instead of transmitted to/from the browser with every request. Or
+move to an [alternative session strategy](https://github.com/expressjs/session#compatible-session-stores)
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/cookie-session.svg
+[npm-url]: https://npmjs.org/package/cookie-session
+[travis-image]: https://img.shields.io/travis/expressjs/cookie-session/master.svg
+[travis-url]: https://travis-ci.org/expressjs/cookie-session
+[coveralls-image]: https://img.shields.io/coveralls/expressjs/cookie-session.svg
+[coveralls-url]: https://coveralls.io/r/expressjs/cookie-session?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/cookie-session.svg
+[downloads-url]: https://npmjs.org/package/cookie-session
+[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
+[gratipay-url]: https://www.gratipay.com/dougwilson/

express-server/node_modules/cookie-session/index.js

@@ -0,0 +1,330 @@
+/*!
+ * cookie-session
+ * Copyright(c) 2013 Jonathan Ong
+ * Copyright(c) 2014-2017 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var Buffer = require('safe-buffer').Buffer
+var debug = require('debug')('cookie-session')
+var Cookies = require('cookies')
+var onHeaders = require('on-headers')
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = cookieSession
+
+/**
+ * Create a new cookie session middleware.
+ *
+ * @param {object} [options]
+ * @param {boolean} [options.httpOnly=true]
+ * @param {array} [options.keys]
+ * @param {string} [options.name=session] Name of the cookie to use
+ * @param {boolean} [options.overwrite=true]
+ * @param {string} [options.secret]
+ * @param {boolean} [options.signed=true]
+ * @return {function} middleware
+ * @public
+ */
+
+function cookieSession (options) {
+  var opts = options || {}
+
+  // cookie name
+  var name = opts.name || 'session'
+
+  // secrets
+  var keys = opts.keys
+  if (!keys && opts.secret) keys = [opts.secret]
+
+  // defaults
+  if (opts.overwrite == null) opts.overwrite = true
+  if (opts.httpOnly == null) opts.httpOnly = true
+  if (opts.signed == null) opts.signed = true
+
+  if (!keys && opts.signed) throw new Error('.keys required.')
+
+  debug('session options %j', opts)
+
+  return function _cookieSession (req, res, next) {
+    var cookies = new Cookies(req, res, {
+      keys: keys
+    })
+    var sess
+
+    // to pass to Session()
+    req.sessionCookies = cookies
+    req.sessionOptions = Object.create(opts)
+    req.sessionKey = name
+
+    // define req.session getter / setter
+    Object.defineProperty(req, 'session', {
+      configurable: true,
+      enumerable: true,
+      get: getSession,
+      set: setSession
+    })
+
+    function getSession () {
+      // already retrieved
+      if (sess) {
+        return sess
+      }
+
+      // unset
+      if (sess === false) {
+        return null
+      }
+
+      // get or create session
+      return (sess = tryGetSession(req) || createSession(req))
+    }
+
+    function setSession (val) {
+      if (val == null) {
+        // unset session
+        sess = false
+        return val
+      }
+
+      if (typeof val === 'object') {
+        // create a new session
+        sess = Session.create(this, val)
+        return sess
+      }
+
+      throw new Error('req.session can only be set as null or an object.')
+    }
+
+    onHeaders(res, function setHeaders () {
+      if (sess === undefined) {
+        // not accessed
+        return
+      }
+
+      try {
+        if (sess === false) {
+          // remove
+          cookies.set(name, '', req.sessionOptions)
+        } else if ((!sess.isNew || sess.isPopulated) && sess.isChanged) {
+          // save populated or non-new changed session
+          sess.save()
+        }
+      } catch (e) {
+        debug('error saving session %s', e.message)
+      }
+    })
+
+    next()
+  }
+};
+
+/**
+ * Session model.
+ *
+ * @param {Context} ctx
+ * @param {Object} obj
+ * @private
+ */
+
+function Session (ctx, obj) {
+  Object.defineProperty(this, '_ctx', {
+    value: ctx
+  })
+
+  if (obj) {
+    for (var key in obj) {
+      this[key] = obj[key]
+    }
+  }
+}
+
+/**
+ * Create new session.
+ * @private
+ */
+
+Session.create = function create (req, obj) {
+  var ctx = new SessionContext(req)
+  return new Session(ctx, obj)
+}
+
+/**
+ * Create session from serialized form.
+ * @private
+ */
+
+Session.deserialize = function deserialize (req, str) {
+  var ctx = new SessionContext(req)
+  var obj = decode(str)
+
+  ctx._new = false
+  ctx._val = str
+
+  return new Session(ctx, obj)
+}
+
+/**
+ * Serialize a session to a string.
+ * @private
+ */
+
+Session.serialize = function serialize (sess) {
+  return encode(sess)
+}
+
+/**
+ * Return if the session is changed for this request.
+ *
+ * @return {Boolean}
+ * @public
+ */
+
+Object.defineProperty(Session.prototype, 'isChanged', {
+  get: function getIsChanged () {
+    return this._ctx._new || this._ctx._val !== Session.serialize(this)
+  }
+})
+
+/**
+ * Return if the session is new for this request.
+ *
+ * @return {Boolean}
+ * @public
+ */
+
+Object.defineProperty(Session.prototype, 'isNew', {
+  get: function getIsNew () {
+    return this._ctx._new
+  }
+})
+
+/**
+ * Return how many values there are in the session object.
+ * Used to see if it's "populated".
+ *
+ * @return {Number}
+ * @public
+ */
+
+Object.defineProperty(Session.prototype, 'length', {
+  get: function getLength () {
+    return Object.keys(this).length
+  }
+})
+
+/**
+ * populated flag, which is just a boolean alias of .length.
+ *
+ * @return {Boolean}
+ * @public
+ */
+
+Object.defineProperty(Session.prototype, 'isPopulated', {
+  get: function getIsPopulated () {
+    return Boolean(this.length)
+  }
+})
+
+/**
+ * Save session changes by performing a Set-Cookie.
+ * @private
+ */
+
+Session.prototype.save = function save () {
+  var ctx = this._ctx
+  var val = Session.serialize(this)
+
+  var cookies = ctx.req.sessionCookies
+  var name = ctx.req.sessionKey
+  var opts = ctx.req.sessionOptions
+
+  debug('save %s', val)
+  cookies.set(name, val, opts)
+}
+
+/**
+ * Session context to tie session to req.
+ *
+ * @param {Request} req
+ * @private
+ */
+
+function SessionContext (req) {
+  this.req = req
+
+  this._new = true
+  this._val = undefined
+}
+
+/**
+ * Create a new session.
+ * @private
+ */
+
+function createSession (req) {
+  debug('new session')
+  return Session.create(req)
+}
+
+/**
+ * Decode the base64 cookie value to an object.
+ *
+ * @param {String} string
+ * @return {Object}
+ * @private
+ */
+
+function decode (string) {
+  var body = Buffer.from(string, 'base64').toString('utf8')
+  return JSON.parse(body)
+}
+
+/**
+ * Encode an object into a base64-encoded JSON string.
+ *
+ * @param {Object} body
+ * @return {String}
+ * @private
+ */
+
+function encode (body) {
+  var str = JSON.stringify(body)
+  return Buffer.from(str).toString('base64')
+}
+
+/**
+ * Try getting a session from a request.
+ * @private
+ */
+
+function tryGetSession (req) {
+  var cookies = req.sessionCookies
+  var name = req.sessionKey
+  var opts = req.sessionOptions
+
+  var str = cookies.get(name, opts)
+
+  if (!str) {
+    return undefined
+  }
+
+  debug('parse %s', str)
+
+  try {
+    return Session.deserialize(req, str)
+  } catch (err) {
+    return undefined
+  }
+}

express-server/node_modules/cookie-session/node_modules/debug/.coveralls.yml

@@ -0,0 +1 @@
+repo_token: SIAeZjKYlHK74rbcFvNHMUzjRiMpflxve

express-server/node_modules/cookie-session/node_modules/debug/.eslintrc

@@ -0,0 +1,14 @@
+{
+  "env": {
+    "browser": true,
+    "node": true
+  },
+  "globals": {
+    "chrome": true
+  },
+  "rules": {
+    "no-console": 0,
+    "no-empty": [1, { "allowEmptyCatch": true }]
+  },
+  "extends": "eslint:recommended"
+}

express-server/node_modules/cookie-session/node_modules/debug/.npmignore

@@ -0,0 +1,9 @@
+support
+test
+examples
+example
+*.sock
+dist
+yarn.lock
+coverage
+bower.json

express-server/node_modules/cookie-session/node_modules/debug/.travis.yml

@@ -0,0 +1,20 @@
+sudo: false
+
+language: node_js
+
+node_js:
+  - "4"
+  - "6"
+  - "8"
+
+install:
+  - make install
+
+script:
+  - make lint
+  - make test
+
+matrix:
+  include:
+  - node_js: '8'
+    env: BROWSER=1

express-server/node_modules/cookie-session/node_modules/debug/CHANGELOG.md

@@ -0,0 +1,395 @@
+
+3.1.0 / 2017-09-26
+==================
+
+  * Add `DEBUG_HIDE_DATE` env var (#486)
+  * Remove ReDoS regexp in %o formatter (#504)
+  * Remove "component" from package.json
+  * Remove `component.json`
+  * Ignore package-lock.json
+  * Examples: fix colors printout
+  * Fix: browser detection
+  * Fix: spelling mistake (#496, @EdwardBetts)
+
+3.0.1 / 2017-08-24
+==================
+
+  * Fix: Disable colors in Edge and Internet Explorer (#489)
+
+3.0.0 / 2017-08-08
+==================
+
+  * Breaking: Remove DEBUG_FD (#406)
+  * Breaking: Use `Date#toISOString()` instead to `Date#toUTCString()` when output is not a TTY (#418)
+  * Breaking: Make millisecond timer namespace specific and allow 'always enabled' output (#408)
+  * Addition: document `enabled` flag (#465)
+  * Addition: add 256 colors mode (#481)
+  * Addition: `enabled()` updates existing debug instances, add `destroy()` function (#440)
+  * Update: component: update "ms" to v2.0.0
+  * Update: separate the Node and Browser tests in Travis-CI
+  * Update: refactor Readme, fixed documentation, added "Namespace Colors" section, redid screenshots
+  * Update: separate Node.js and web browser examples for organization
+  * Update: update "browserify" to v14.4.0
+  * Fix: fix Readme typo (#473)
+
+2.6.9 / 2017-09-22
+==================
+
+  * remove ReDoS regexp in %o formatter (#504)
+
+2.6.8 / 2017-05-18
+==================
+
+  * Fix: Check for undefined on browser globals (#462, @marbemac)
+
+2.6.7 / 2017-05-16
+==================
+
+  * Fix: Update ms to 2.0.0 to fix regular expression denial of service vulnerability (#458, @hubdotcom)
+  * Fix: Inline extend function in node implementation (#452, @dougwilson)
+  * Docs: Fix typo (#455, @msasad)
+
+2.6.5 / 2017-04-27
+==================
+  
+  * Fix: null reference check on window.documentElement.style.WebkitAppearance (#447, @thebigredgeek)
+  * Misc: clean up browser reference checks (#447, @thebigredgeek)
+  * Misc: add npm-debug.log to .gitignore (@thebigredgeek)
+
+
+2.6.4 / 2017-04-20
+==================
+
+  * Fix: bug that would occur if process.env.DEBUG is a non-string value. (#444, @LucianBuzzo)
+  * Chore: ignore bower.json in npm installations. (#437, @joaovieira)
+  * Misc: update "ms" to v0.7.3 (@tootallnate)
+
+2.6.3 / 2017-03-13
+==================
+
+  * Fix: Electron reference to `process.env.DEBUG` (#431, @paulcbetts)
+  * Docs: Changelog fix (@thebigredgeek)
+
+2.6.2 / 2017-03-10
+==================
+
+  * Fix: DEBUG_MAX_ARRAY_LENGTH (#420, @slavaGanzin)
+  * Docs: Add backers and sponsors from Open Collective (#422, @piamancini)
+  * Docs: Add Slackin invite badge (@tootallnate)
+
+2.6.1 / 2017-02-10
+==================
+
+  * Fix: Module's `export default` syntax fix for IE8 `Expected identifier` error
+  * Fix: Whitelist DEBUG_FD for values 1 and 2 only (#415, @pi0)
+  * Fix: IE8 "Expected identifier" error (#414, @vgoma)
+  * Fix: Namespaces would not disable once enabled (#409, @musikov)
+
+2.6.0 / 2016-12-28
+==================
+
+  * Fix: added better null pointer checks for browser useColors (@thebigredgeek)
+  * Improvement: removed explicit `window.debug` export (#404, @tootallnate)
+  * Improvement: deprecated `DEBUG_FD` environment variable (#405, @tootallnate)
+
+2.5.2 / 2016-12-25
+==================
+
+  * Fix: reference error on window within webworkers (#393, @KlausTrainer)
+  * Docs: fixed README typo (#391, @lurch)
+  * Docs: added notice about v3 api discussion (@thebigredgeek)
+
+2.5.1 / 2016-12-20
+==================
+
+  * Fix: babel-core compatibility
+
+2.5.0 / 2016-12-20
+==================
+
+  * Fix: wrong reference in bower file (@thebigredgeek)
+  * Fix: webworker compatibility (@thebigredgeek)
+  * Fix: output formatting issue (#388, @kribblo)
+  * Fix: babel-loader compatibility (#383, @escwald)
+  * Misc: removed built asset from repo and publications (@thebigredgeek)
+  * Misc: moved source files to /src (#378, @yamikuronue)
+  * Test: added karma integration and replaced babel with browserify for browser tests (#378, @yamikuronue)
+  * Test: coveralls integration (#378, @yamikuronue)
+  * Docs: simplified language in the opening paragraph (#373, @yamikuronue)
+
+2.4.5 / 2016-12-17
+==================
+
+  * Fix: `navigator` undefined in Rhino (#376, @jochenberger)
+  * Fix: custom log function (#379, @hsiliev)
+  * Improvement: bit of cleanup + linting fixes (@thebigredgeek)
+  * Improvement: rm non-maintainted `dist/` dir (#375, @freewil)
+  * Docs: simplified language in the opening paragraph. (#373, @yamikuronue)
+
+2.4.4 / 2016-12-14
+==================
+
+  * Fix: work around debug being loaded in preload scripts for electron (#368, @paulcbetts)
+
+2.4.3 / 2016-12-14
+==================
+
+  * Fix: navigation.userAgent error for react native (#364, @escwald)
+
+2.4.2 / 2016-12-14
+==================
+
+  * Fix: browser colors (#367, @tootallnate)
+  * Misc: travis ci integration (@thebigredgeek)
+  * Misc: added linting and testing boilerplate with sanity check (@thebigredgeek)
+
+2.4.1 / 2016-12-13
+==================
+
+  * Fix: typo that broke the package (#356)
+
+2.4.0 / 2016-12-13
+==================
+
+  * Fix: bower.json references unbuilt src entry point (#342, @justmatt)
+  * Fix: revert "handle regex special characters" (@tootallnate)
+  * Feature: configurable util.inspect()`options for NodeJS (#327, @tootallnate)
+  * Feature: %O`(big O) pretty-prints objects (#322, @tootallnate)
+  * Improvement: allow colors in workers (#335, @botverse)
+  * Improvement: use same color for same namespace. (#338, @lchenay)
+
+2.3.3 / 2016-11-09
+==================
+
+  * Fix: Catch `JSON.stringify()` errors (#195, Jovan Alleyne)
+  * Fix: Returning `localStorage` saved values (#331, Levi Thomason)
+  * Improvement: Don't create an empty object when no `process` (Nathan Rajlich)
+
+2.3.2 / 2016-11-09
+==================
+
+  * Fix: be super-safe in index.js as well (@TooTallNate)
+  * Fix: should check whether process exists (Tom Newby)
+
+2.3.1 / 2016-11-09
+==================
+
+  * Fix: Added electron compatibility (#324, @paulcbetts)
+  * Improvement: Added performance optimizations (@tootallnate)
+  * Readme: Corrected PowerShell environment variable example (#252, @gimre)
+  * Misc: Removed yarn lock file from source control (#321, @fengmk2)
+
+2.3.0 / 2016-11-07
+==================
+
+  * Fix: Consistent placement of ms diff at end of output (#215, @gorangajic)
+  * Fix: Escaping of regex special characters in namespace strings (#250, @zacronos)
+  * Fix: Fixed bug causing crash on react-native (#282, @vkarpov15)
+  * Feature: Enabled ES6+ compatible import via default export (#212 @bucaran)
+  * Feature: Added %O formatter to reflect Chrome's console.log capability (#279, @oncletom)
+  * Package: Update "ms" to 0.7.2 (#315, @DevSide)
+  * Package: removed superfluous version property from bower.json (#207 @kkirsche)
+  * Readme: fix USE_COLORS to DEBUG_COLORS
+  * Readme: Doc fixes for format string sugar (#269, @mlucool)
+  * Readme: Updated docs for DEBUG_FD and DEBUG_COLORS environment variables (#232, @mattlyons0)
+  * Readme: doc fixes for PowerShell (#271 #243, @exoticknight @unreadable)
+  * Readme: better docs for browser support (#224, @matthewmueller)
+  * Tooling: Added yarn integration for development (#317, @thebigredgeek)
+  * Misc: Renamed History.md to CHANGELOG.md (@thebigredgeek)
+  * Misc: Added license file (#226 #274, @CantemoInternal @sdaitzman)
+  * Misc: Updated contributors (@thebigredgeek)
+
+2.2.0 / 2015-05-09
+==================
+
+  * package: update "ms" to v0.7.1 (#202, @dougwilson)
+  * README: add logging to file example (#193, @DanielOchoa)
+  * README: fixed a typo (#191, @amir-s)
+  * browser: expose `storage` (#190, @stephenmathieson)
+  * Makefile: add a `distclean` target (#189, @stephenmathieson)
+
+2.1.3 / 2015-03-13
+==================
+
+  * Updated stdout/stderr example (#186)
+  * Updated example/stdout.js to match debug current behaviour
+  * Renamed example/stderr.js to stdout.js
+  * Update Readme.md (#184)
+  * replace high intensity foreground color for bold (#182, #183)
+
+2.1.2 / 2015-03-01
+==================
+
+  * dist: recompile
+  * update "ms" to v0.7.0
+  * package: update "browserify" to v9.0.3
+  * component: fix "ms.js" repo location
+  * changed bower package name
+  * updated documentation about using debug in a browser
+  * fix: security error on safari (#167, #168, @yields)
+
+2.1.1 / 2014-12-29
+==================
+
+  * browser: use `typeof` to check for `console` existence
+  * browser: check for `console.log` truthiness (fix IE 8/9)
+  * browser: add support for Chrome apps
+  * Readme: added Windows usage remarks
+  * Add `bower.json` to properly support bower install
+
+2.1.0 / 2014-10-15
+==================
+
+  * node: implement `DEBUG_FD` env variable support
+  * package: update "browserify" to v6.1.0
+  * package: add "license" field to package.json (#135, @panuhorsmalahti)
+
+2.0.0 / 2014-09-01
+==================
+
+  * package: update "browserify" to v5.11.0
+  * node: use stderr rather than stdout for logging (#29, @stephenmathieson)
+
+1.0.4 / 2014-07-15
+==================
+
+  * dist: recompile
+  * example: remove `console.info()` log usage
+  * example: add "Content-Type" UTF-8 header to browser example
+  * browser: place %c marker after the space character
+  * browser: reset the "content" color via `color: inherit`
+  * browser: add colors support for Firefox >= v31
+  * debug: prefer an instance `log()` function over the global one (#119)
+  * Readme: update documentation about styled console logs for FF v31 (#116, @wryk)
+
+1.0.3 / 2014-07-09
+==================
+
+  * Add support for multiple wildcards in namespaces (#122, @seegno)
+  * browser: fix lint
+
+1.0.2 / 2014-06-10
+==================
+
+  * browser: update color palette (#113, @gscottolson)
+  * common: make console logging function configurable (#108, @timoxley)
+  * node: fix %o colors on old node <= 0.8.x
+  * Makefile: find node path using shell/which (#109, @timoxley)
+
+1.0.1 / 2014-06-06
+==================
+
+  * browser: use `removeItem()` to clear localStorage
+  * browser, node: don't set DEBUG if namespaces is undefined (#107, @leedm777)
+  * package: add "contributors" section
+  * node: fix comment typo
+  * README: list authors
+
+1.0.0 / 2014-06-04
+==================
+
+  * make ms diff be global, not be scope
+  * debug: ignore empty strings in enable()
+  * node: make DEBUG_COLORS able to disable coloring
+  * *: export the `colors` array
+  * npmignore: don't publish the `dist` dir
+  * Makefile: refactor to use browserify
+  * package: add "browserify" as a dev dependency
+  * Readme: add Web Inspector Colors section
+  * node: reset terminal color for the debug content
+  * node: map "%o" to `util.inspect()`
+  * browser: map "%j" to `JSON.stringify()`
+  * debug: add custom "formatters"
+  * debug: use "ms" module for humanizing the diff
+  * Readme: add "bash" syntax highlighting
+  * browser: add Firebug color support
+  * browser: add colors for WebKit browsers
+  * node: apply log to `console`
+  * rewrite: abstract common logic for Node & browsers
+  * add .jshintrc file
+
+0.8.1 / 2014-04-14
+==================
+
+  * package: re-add the "component" section
+
+0.8.0 / 2014-03-30
+==================
+
+  * add `enable()` method for nodejs. Closes #27
+  * change from stderr to stdout
+  * remove unnecessary index.js file
+
+0.7.4 / 2013-11-13
+==================
+
+  * remove "browserify" key from package.json (fixes something in browserify)
+
+0.7.3 / 2013-10-30
+==================
+
+  * fix: catch localStorage security error when cookies are blocked (Chrome)
+  * add debug(err) support. Closes #46
+  * add .browser prop to package.json. Closes #42
+
+0.7.2 / 2013-02-06
+==================
+
+  * fix package.json
+  * fix: Mobile Safari (private mode) is broken with debug
+  * fix: Use unicode to send escape character to shell instead of octal to work with strict mode javascript
+
+0.7.1 / 2013-02-05
+==================
+
+  * add repository URL to package.json
+  * add DEBUG_COLORED to force colored output
+  * add browserify support
+  * fix component. Closes #24
+
+0.7.0 / 2012-05-04
+==================
+
+  * Added .component to package.json
+  * Added debug.component.js build
+
+0.6.0 / 2012-03-16
+==================
+
+  * Added support for "-" prefix in DEBUG [Vinay Pulim]
+  * Added `.enabled` flag to the node version [TooTallNate]
+
+0.5.0 / 2012-02-02
+==================
+
+  * Added: humanize diffs. Closes #8
+  * Added `debug.disable()` to the CS variant
+  * Removed padding. Closes #10
+  * Fixed: persist client-side variant again. Closes #9
+
+0.4.0 / 2012-02-01
+==================
+
+  * Added browser variant support for older browsers [TooTallNate]
+  * Added `debug.enable('project:*')` to browser variant [TooTallNate]
+  * Added padding to diff (moved it to the right)
+
+0.3.0 / 2012-01-26
+==================
+
+  * Added millisecond diff when isatty, otherwise UTC string
+
+0.2.0 / 2012-01-22
+==================
+
+  * Added wildcard support
+
+0.1.0 / 2011-12-02
+==================
+
+  * Added: remove colors unless stderr isatty [TooTallNate]
+
+0.0.1 / 2010-01-03
+==================
+
+  * Initial release

express-server/node_modules/cookie-session/node_modules/debug/LICENSE

@@ -0,0 +1,19 @@
+(The MIT License)
+
+Copyright (c) 2014 TJ Holowaychuk <tj@vision-media.ca>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software 
+and associated documentation files (the 'Software'), to deal in the Software without restriction, 
+including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, 
+and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial 
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT 
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

express-server/node_modules/cookie-session/node_modules/debug/Makefile

@@ -0,0 +1,58 @@
+# get Makefile directory name: http://stackoverflow.com/a/5982798/376773
+THIS_MAKEFILE_PATH:=$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST))
+THIS_DIR:=$(shell cd $(dir $(THIS_MAKEFILE_PATH));pwd)
+
+# BIN directory
+BIN := $(THIS_DIR)/node_modules/.bin
+
+# Path
+PATH := node_modules/.bin:$(PATH)
+SHELL := /bin/bash
+
+# applications
+NODE ?= $(shell which node)
+YARN ?= $(shell which yarn)
+PKG ?= $(if $(YARN),$(YARN),$(NODE) $(shell which npm))
+BROWSERIFY ?= $(NODE) $(BIN)/browserify
+
+install: node_modules
+
+browser: dist/debug.js
+
+node_modules: package.json
+	@NODE_ENV= $(PKG) install
+	@touch node_modules
+
+dist/debug.js: src/*.js node_modules
+	@mkdir -p dist
+	@$(BROWSERIFY) \
+		--standalone debug \
+		. > dist/debug.js
+
+lint:
+	@eslint *.js src/*.js
+
+test-node:
+	@istanbul cover node_modules/mocha/bin/_mocha -- test/**.js
+	@cat ./coverage/lcov.info | ./node_modules/coveralls/bin/coveralls.js
+
+test-browser:
+	@$(MAKE) browser
+	@karma start --single-run
+
+test-all:
+	@concurrently \
+		"make test-node" \
+		"make test-browser"
+
+test:
+	@if [ "x$(BROWSER)" = "x" ]; then \
+		$(MAKE) test-node; \
+		else \
+		$(MAKE) test-browser; \
+	fi
+
+clean:
+	rimraf dist coverage
+
+.PHONY: browser install clean lint test test-all test-node test-browser

express-server/node_modules/cookie-session/node_modules/debug/README.md

@@ -0,0 +1,368 @@
+# debug
+[![Build Status](https://travis-ci.org/visionmedia/debug.svg?branch=master)](https://travis-ci.org/visionmedia/debug)  [![Coverage Status](https://coveralls.io/repos/github/visionmedia/debug/badge.svg?branch=master)](https://coveralls.io/github/visionmedia/debug?branch=master)  [![Slack](https://visionmedia-community-slackin.now.sh/badge.svg)](https://visionmedia-community-slackin.now.sh/) [![OpenCollective](https://opencollective.com/debug/backers/badge.svg)](#backers)
+[![OpenCollective](https://opencollective.com/debug/sponsors/badge.svg)](#sponsors)
+
+<img width="647" src="https://user-images.githubusercontent.com/71256/29091486-fa38524c-7c37-11e7-895f-e7ec8e1039b6.png">
+
+A tiny JavaScript debugging utility modelled after Node.js core's debugging
+technique. Works in Node.js and web browsers.
+
+## Installation
+
+```bash
+$ npm install debug
+```
+
+## Usage
+
+`debug` exposes a function; simply pass this function the name of your module, and it will return a decorated version of `console.error` for you to pass debug statements to. This will allow you to toggle the debug output for different parts of your module as well as the module as a whole.
+
+Example [_app.js_](./examples/node/app.js):
+
+```js
+var debug = require('debug')('http')
+  , http = require('http')
+  , name = 'My App';
+
+// fake app
+
+debug('booting %o', name);
+
+http.createServer(function(req, res){
+  debug(req.method + ' ' + req.url);
+  res.end('hello\n');
+}).listen(3000, function(){
+  debug('listening');
+});
+
+// fake worker of some kind
+
+require('./worker');
+```
+
+Example [_worker.js_](./examples/node/worker.js):
+
+```js
+var a = require('debug')('worker:a')
+  , b = require('debug')('worker:b');
+
+function work() {
+  a('doing lots of uninteresting work');
+  setTimeout(work, Math.random() * 1000);
+}
+
+work();
+
+function workb() {
+  b('doing some work');
+  setTimeout(workb, Math.random() * 2000);
+}
+
+workb();
+```
+
+The `DEBUG` environment variable is then used to enable these based on space or
+comma-delimited names.
+
+Here are some examples:
+
+<img width="647" alt="screen shot 2017-08-08 at 12 53 04 pm" src="https://user-images.githubusercontent.com/71256/29091703-a6302cdc-7c38-11e7-8304-7c0b3bc600cd.png">
+<img width="647" alt="screen shot 2017-08-08 at 12 53 38 pm" src="https://user-images.githubusercontent.com/71256/29091700-a62a6888-7c38-11e7-800b-db911291ca2b.png">
+<img width="647" alt="screen shot 2017-08-08 at 12 53 25 pm" src="https://user-images.githubusercontent.com/71256/29091701-a62ea114-7c38-11e7-826a-2692bedca740.png">
+
+#### Windows note
+
+On Windows the environment variable is set using the `set` command.
+
+```cmd
+set DEBUG=*,-not_this
+```
+
+Note that PowerShell uses different syntax to set environment variables.
+
+```cmd
+$env:DEBUG = "*,-not_this"
+```
+
+Then, run the program to be debugged as usual.
+
+
+## Namespace Colors
+
+Every debug instance has a color generated for it based on its namespace name.
+This helps when visually parsing the debug output to identify which debug instance
+a debug line belongs to.
+
+#### Node.js
+
+In Node.js, colors are enabled when stderr is a TTY. You also _should_ install
+the [`supports-color`](https://npmjs.org/supports-color) module alongside debug,
+otherwise debug will only use a small handful of basic colors.
+
+<img width="521" src="https://user-images.githubusercontent.com/71256/29092181-47f6a9e6-7c3a-11e7-9a14-1928d8a711cd.png">
+
+#### Web Browser
+
+Colors are also enabled on "Web Inspectors" that understand the `%c` formatting
+option. These are WebKit web inspectors, Firefox ([since version
+31](https://hacks.mozilla.org/2014/05/editable-box-model-multiple-selection-sublime-text-keys-much-more-firefox-developer-tools-episode-31/))
+and the Firebug plugin for Firefox (any version).
+
+<img width="524" src="https://user-images.githubusercontent.com/71256/29092033-b65f9f2e-7c39-11e7-8e32-f6f0d8e865c1.png">
+
+
+## Millisecond diff
+
+When actively developing an application it can be useful to see when the time spent between one `debug()` call and the next. Suppose for example you invoke `debug()` before requesting a resource, and after as well, the "+NNNms" will show you how much time was spent between calls.
+
+<img width="647" src="https://user-images.githubusercontent.com/71256/29091486-fa38524c-7c37-11e7-895f-e7ec8e1039b6.png">
+
+When stdout is not a TTY, `Date#toISOString()` is used, making it more useful for logging the debug information as shown below:
+
+<img width="647" src="https://user-images.githubusercontent.com/71256/29091956-6bd78372-7c39-11e7-8c55-c948396d6edd.png">
+
+
+## Conventions
+
+If you're using this in one or more of your libraries, you _should_ use the name of your library so that developers may toggle debugging as desired without guessing names. If you have more than one debuggers you _should_ prefix them with your library name and use ":" to separate features. For example "bodyParser" from Connect would then be "connect:bodyParser".  If you append a "*" to the end of your name, it will always be enabled regardless of the setting of the DEBUG environment variable.  You can then use it for normal output as well as debug output.
+
+## Wildcards
+
+The `*` character may be used as a wildcard. Suppose for example your library has
+debuggers named "connect:bodyParser", "connect:compress", "connect:session",
+instead of listing all three with
+`DEBUG=connect:bodyParser,connect:compress,connect:session`, you may simply do
+`DEBUG=connect:*`, or to run everything using this module simply use `DEBUG=*`.
+
+You can also exclude specific debuggers by prefixing them with a "-" character.
+For example, `DEBUG=*,-connect:*` would include all debuggers except those
+starting with "connect:".
+
+## Environment Variables
+
+When running through Node.js, you can set a few environment variables that will
+change the behavior of the debug logging:
+
+| Name      | Purpose                                         |
+|-----------|-------------------------------------------------|
+| `DEBUG`   | Enables/disables specific debugging namespaces. |
+| `DEBUG_HIDE_DATE` | Hide date from debug output (non-TTY).  |
+| `DEBUG_COLORS`| Whether or not to use colors in the debug output. |
+| `DEBUG_DEPTH` | Object inspection depth.                    |
+| `DEBUG_SHOW_HIDDEN` | Shows hidden properties on inspected objects. |
+
+
+__Note:__ The environment variables beginning with `DEBUG_` end up being
+converted into an Options object that gets used with `%o`/`%O` formatters.
+See the Node.js documentation for
+[`util.inspect()`](https://nodejs.org/api/util.html#util_util_inspect_object_options)
+for the complete list.
+
+## Formatters
+
+Debug uses [printf-style](https://wikipedia.org/wiki/Printf_format_string) formatting.
+Below are the officially supported formatters:
+
+| Formatter | Representation |
+|-----------|----------------|
+| `%O`      | Pretty-print an Object on multiple lines. |
+| `%o`      | Pretty-print an Object all on a single line. |
+| `%s`      | String. |
+| `%d`      | Number (both integer and float). |
+| `%j`      | JSON. Replaced with the string '[Circular]' if the argument contains circular references. |
+| `%%`      | Single percent sign ('%'). This does not consume an argument. |
+
+
+### Custom formatters
+
+You can add custom formatters by extending the `debug.formatters` object.
+For example, if you wanted to add support for rendering a Buffer as hex with
+`%h`, you could do something like:
+
+```js
+const createDebug = require('debug')
+createDebug.formatters.h = (v) => {
+  return v.toString('hex')
+}
+
+// …elsewhere
+const debug = createDebug('foo')
+debug('this is hex: %h', new Buffer('hello world'))
+//   foo this is hex: 68656c6c6f20776f726c6421 +0ms
+```
+
+
+## Browser Support
+
+You can build a browser-ready script using [browserify](https://github.com/substack/node-browserify),
+or just use the [browserify-as-a-service](https://wzrd.in/) [build](https://wzrd.in/standalone/debug@latest),
+if you don't want to build it yourself.
+
+Debug's enable state is currently persisted by `localStorage`.
+Consider the situation shown below where you have `worker:a` and `worker:b`,
+and wish to debug both. You can enable this using `localStorage.debug`:
+
+```js
+localStorage.debug = 'worker:*'
+```
+
+And then refresh the page.
+
+```js
+a = debug('worker:a');
+b = debug('worker:b');
+
+setInterval(function(){
+  a('doing some work');
+}, 1000);
+
+setInterval(function(){
+  b('doing some work');
+}, 1200);
+```
+
+
+## Output streams
+
+  By default `debug` will log to stderr, however this can be configured per-namespace by overriding the `log` method:
+
+Example [_stdout.js_](./examples/node/stdout.js):
+
+```js
+var debug = require('debug');
+var error = debug('app:error');
+
+// by default stderr is used
+error('goes to stderr!');
+
+var log = debug('app:log');
+// set this namespace to log via console.log
+log.log = console.log.bind(console); // don't forget to bind to console!
+log('goes to stdout');
+error('still goes to stderr!');
+
+// set all output to go via console.info
+// overrides all per-namespace log settings
+debug.log = console.info.bind(console);
+error('now goes to stdout via console.info');
+log('still goes to stdout, but via console.info now');
+```
+
+## Checking whether a debug target is enabled
+
+After you've created a debug instance, you can determine whether or not it is
+enabled by checking the `enabled` property:
+
+```javascript
+const debug = require('debug')('http');
+
+if (debug.enabled) {
+  // do stuff...
+}
+```
+
+You can also manually toggle this property to force the debug instance to be
+enabled or disabled.
+
+
+## Authors
+
+ - TJ Holowaychuk
+ - Nathan Rajlich
+ - Andrew Rhyne
+
+## Backers
+
+Support us with a monthly donation and help us continue our activities. [[Become a backer](https://opencollective.com/debug#backer)]
+
+<a href="https://opencollective.com/debug/backer/0/website" target="_blank"><img src="https://opencollective.com/debug/backer/0/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/1/website" target="_blank"><img src="https://opencollective.com/debug/backer/1/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/2/website" target="_blank"><img src="https://opencollective.com/debug/backer/2/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/3/website" target="_blank"><img src="https://opencollective.com/debug/backer/3/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/4/website" target="_blank"><img src="https://opencollective.com/debug/backer/4/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/5/website" target="_blank"><img src="https://opencollective.com/debug/backer/5/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/6/website" target="_blank"><img src="https://opencollective.com/debug/backer/6/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/7/website" target="_blank"><img src="https://opencollective.com/debug/backer/7/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/8/website" target="_blank"><img src="https://opencollective.com/debug/backer/8/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/9/website" target="_blank"><img src="https://opencollective.com/debug/backer/9/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/10/website" target="_blank"><img src="https://opencollective.com/debug/backer/10/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/11/website" target="_blank"><img src="https://opencollective.com/debug/backer/11/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/12/website" target="_blank"><img src="https://opencollective.com/debug/backer/12/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/13/website" target="_blank"><img src="https://opencollective.com/debug/backer/13/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/14/website" target="_blank"><img src="https://opencollective.com/debug/backer/14/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/15/website" target="_blank"><img src="https://opencollective.com/debug/backer/15/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/16/website" target="_blank"><img src="https://opencollective.com/debug/backer/16/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/17/website" target="_blank"><img src="https://opencollective.com/debug/backer/17/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/18/website" target="_blank"><img src="https://opencollective.com/debug/backer/18/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/19/website" target="_blank"><img src="https://opencollective.com/debug/backer/19/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/20/website" target="_blank"><img src="https://opencollective.com/debug/backer/20/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/21/website" target="_blank"><img src="https://opencollective.com/debug/backer/21/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/22/website" target="_blank"><img src="https://opencollective.com/debug/backer/22/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/23/website" target="_blank"><img src="https://opencollective.com/debug/backer/23/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/24/website" target="_blank"><img src="https://opencollective.com/debug/backer/24/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/25/website" target="_blank"><img src="https://opencollective.com/debug/backer/25/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/26/website" target="_blank"><img src="https://opencollective.com/debug/backer/26/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/27/website" target="_blank"><img src="https://opencollective.com/debug/backer/27/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/28/website" target="_blank"><img src="https://opencollective.com/debug/backer/28/avatar.svg"></a>
+<a href="https://opencollective.com/debug/backer/29/website" target="_blank"><img src="https://opencollective.com/debug/backer/29/avatar.svg"></a>
+
+
+## Sponsors
+
+Become a sponsor and get your logo on our README on Github with a link to your site. [[Become a sponsor](https://opencollective.com/debug#sponsor)]
+
+<a href="https://opencollective.com/debug/sponsor/0/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/0/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/1/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/1/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/2/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/2/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/3/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/3/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/4/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/4/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/5/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/5/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/6/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/6/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/7/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/7/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/8/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/8/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/9/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/9/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/10/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/10/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/11/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/11/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/12/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/12/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/13/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/13/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/14/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/14/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/15/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/15/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/16/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/16/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/17/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/17/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/18/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/18/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/19/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/19/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/20/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/20/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/21/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/21/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/22/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/22/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/23/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/23/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/24/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/24/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/25/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/25/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/26/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/26/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/27/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/27/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/28/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/28/avatar.svg"></a>
+<a href="https://opencollective.com/debug/sponsor/29/website" target="_blank"><img src="https://opencollective.com/debug/sponsor/29/avatar.svg"></a>
+
+## License
+
+(The MIT License)
+
+Copyright (c) 2014-2017 TJ Holowaychuk &lt;tj@vision-media.ca&gt;
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

express-server/node_modules/cookie-session/node_modules/debug/karma.conf.js

@@ -0,0 +1,70 @@
+// Karma configuration
+// Generated on Fri Dec 16 2016 13:09:51 GMT+0000 (UTC)
+
+module.exports = function(config) {
+  config.set({
+
+    // base path that will be used to resolve all patterns (eg. files, exclude)
+    basePath: '',
+
+
+    // frameworks to use
+    // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
+    frameworks: ['mocha', 'chai', 'sinon'],
+
+
+    // list of files / patterns to load in the browser
+    files: [
+      'dist/debug.js',
+      'test/*spec.js'
+    ],
+
+
+    // list of files to exclude
+    exclude: [
+      'src/node.js'
+    ],
+
+
+    // preprocess matching files before serving them to the browser
+    // available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor
+    preprocessors: {
+    },
+
+    // test results reporter to use
+    // possible values: 'dots', 'progress'
+    // available reporters: https://npmjs.org/browse/keyword/karma-reporter
+    reporters: ['progress'],
+
+
+    // web server port
+    port: 9876,
+
+
+    // enable / disable colors in the output (reporters and logs)
+    colors: true,
+
+
+    // level of logging
+    // possible values: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
+    logLevel: config.LOG_INFO,
+
+
+    // enable / disable watching file and executing tests whenever any file changes
+    autoWatch: true,
+
+
+    // start these browsers
+    // available browser launchers: https://npmjs.org/browse/keyword/karma-launcher
+    browsers: ['PhantomJS'],
+
+
+    // Continuous Integration mode
+    // if true, Karma captures browsers, runs the tests and exits
+    singleRun: false,
+
+    // Concurrency level
+    // how many browser should be started simultaneous
+    concurrency: Infinity
+  })
+}

express-server/node_modules/cookie-session/node_modules/debug/node.js

@@ -0,0 +1 @@
+module.exports = require('./src/node');

express-server/node_modules/cookie-session/node_modules/debug/package.json

@@ -0,0 +1,82 @@
+{
+  "_from": "debug@3.1.0",
+  "_id": "debug@3.1.0",
+  "_inBundle": false,
+  "_integrity": "sha512-OX8XqP7/1a9cqkxYw2yXss15f26NKWBpDXQd0/uK/KPqdQhxbPa994hnzjcE2VqQpDslf55723cKPUOGSmMY3g==",
+  "_location": "/cookie-session/debug",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "debug@3.1.0",
+    "name": "debug",
+    "escapedName": "debug",
+    "rawSpec": "3.1.0",
+    "saveSpec": null,
+    "fetchSpec": "3.1.0"
+  },
+  "_requiredBy": [
+    "/cookie-session"
+  ],
+  "_resolved": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz",
+  "_shasum": "5bb5a0672628b64149566ba16819e61518c67261",
+  "_spec": "debug@3.1.0",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\cookie-session",
+  "author": {
+    "name": "TJ Holowaychuk",
+    "email": "tj@vision-media.ca"
+  },
+  "browser": "./src/browser.js",
+  "bugs": {
+    "url": "https://github.com/visionmedia/debug/issues"
+  },
+  "bundleDependencies": false,
+  "contributors": [
+    {
+      "name": "Nathan Rajlich",
+      "email": "nathan@tootallnate.net",
+      "url": "http://n8.io"
+    },
+    {
+      "name": "Andrew Rhyne",
+      "email": "rhyneandrew@gmail.com"
+    }
+  ],
+  "dependencies": {
+    "ms": "2.0.0"
+  },
+  "deprecated": false,
+  "description": "small debugging utility",
+  "devDependencies": {
+    "browserify": "14.4.0",
+    "chai": "^3.5.0",
+    "concurrently": "^3.1.0",
+    "coveralls": "^2.11.15",
+    "eslint": "^3.12.1",
+    "istanbul": "^0.4.5",
+    "karma": "^1.3.0",
+    "karma-chai": "^0.1.0",
+    "karma-mocha": "^1.3.0",
+    "karma-phantomjs-launcher": "^1.0.2",
+    "karma-sinon": "^1.0.5",
+    "mocha": "^3.2.0",
+    "mocha-lcov-reporter": "^1.2.0",
+    "rimraf": "^2.5.4",
+    "sinon": "^1.17.6",
+    "sinon-chai": "^2.8.0"
+  },
+  "homepage": "https://github.com/visionmedia/debug#readme",
+  "keywords": [
+    "debug",
+    "log",
+    "debugger"
+  ],
+  "license": "MIT",
+  "main": "./src/index.js",
+  "name": "debug",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/visionmedia/debug.git"
+  },
+  "version": "3.1.0"
+}

express-server/node_modules/cookie-session/node_modules/debug/src/browser.js

@@ -0,0 +1,195 @@
+/**
+ * This is the web browser implementation of `debug()`.
+ *
+ * Expose `debug()` as the module.
+ */
+
+exports = module.exports = require('./debug');
+exports.log = log;
+exports.formatArgs = formatArgs;
+exports.save = save;
+exports.load = load;
+exports.useColors = useColors;
+exports.storage = 'undefined' != typeof chrome
+               && 'undefined' != typeof chrome.storage
+                  ? chrome.storage.local
+                  : localstorage();
+
+/**
+ * Colors.
+ */
+
+exports.colors = [
+  '#0000CC', '#0000FF', '#0033CC', '#0033FF', '#0066CC', '#0066FF', '#0099CC',
+  '#0099FF', '#00CC00', '#00CC33', '#00CC66', '#00CC99', '#00CCCC', '#00CCFF',
+  '#3300CC', '#3300FF', '#3333CC', '#3333FF', '#3366CC', '#3366FF', '#3399CC',
+  '#3399FF', '#33CC00', '#33CC33', '#33CC66', '#33CC99', '#33CCCC', '#33CCFF',
+  '#6600CC', '#6600FF', '#6633CC', '#6633FF', '#66CC00', '#66CC33', '#9900CC',
+  '#9900FF', '#9933CC', '#9933FF', '#99CC00', '#99CC33', '#CC0000', '#CC0033',
+  '#CC0066', '#CC0099', '#CC00CC', '#CC00FF', '#CC3300', '#CC3333', '#CC3366',
+  '#CC3399', '#CC33CC', '#CC33FF', '#CC6600', '#CC6633', '#CC9900', '#CC9933',
+  '#CCCC00', '#CCCC33', '#FF0000', '#FF0033', '#FF0066', '#FF0099', '#FF00CC',
+  '#FF00FF', '#FF3300', '#FF3333', '#FF3366', '#FF3399', '#FF33CC', '#FF33FF',
+  '#FF6600', '#FF6633', '#FF9900', '#FF9933', '#FFCC00', '#FFCC33'
+];
+
+/**
+ * Currently only WebKit-based Web Inspectors, Firefox >= v31,
+ * and the Firebug extension (any Firefox version) are known
+ * to support "%c" CSS customizations.
+ *
+ * TODO: add a `localStorage` variable to explicitly enable/disable colors
+ */
+
+function useColors() {
+  // NB: In an Electron preload script, document will be defined but not fully
+  // initialized. Since we know we're in Chrome, we'll just detect this case
+  // explicitly
+  if (typeof window !== 'undefined' && window.process && window.process.type === 'renderer') {
+    return true;
+  }
+
+  // Internet Explorer and Edge do not support colors.
+  if (typeof navigator !== 'undefined' && navigator.userAgent && navigator.userAgent.toLowerCase().match(/(edge|trident)\/(\d+)/)) {
+    return false;
+  }
+
+  // is webkit? http://stackoverflow.com/a/16459606/376773
+  // document is undefined in react-native: https://github.com/facebook/react-native/pull/1632
+  return (typeof document !== 'undefined' && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance) ||
+    // is firebug? http://stackoverflow.com/a/398120/376773
+    (typeof window !== 'undefined' && window.console && (window.console.firebug || (window.console.exception && window.console.table))) ||
+    // is firefox >= v31?
+    // https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
+    (typeof navigator !== 'undefined' && navigator.userAgent && navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/) && parseInt(RegExp.$1, 10) >= 31) ||
+    // double check webkit in userAgent just in case we are in a worker
+    (typeof navigator !== 'undefined' && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/));
+}
+
+/**
+ * Map %j to `JSON.stringify()`, since no Web Inspectors do that by default.
+ */
+
+exports.formatters.j = function(v) {
+  try {
+    return JSON.stringify(v);
+  } catch (err) {
+    return '[UnexpectedJSONParseError]: ' + err.message;
+  }
+};
+
+
+/**
+ * Colorize log arguments if enabled.
+ *
+ * @api public
+ */
+
+function formatArgs(args) {
+  var useColors = this.useColors;
+
+  args[0] = (useColors ? '%c' : '')
+    + this.namespace
+    + (useColors ? ' %c' : ' ')
+    + args[0]
+    + (useColors ? '%c ' : ' ')
+    + '+' + exports.humanize(this.diff);
+
+  if (!useColors) return;
+
+  var c = 'color: ' + this.color;
+  args.splice(1, 0, c, 'color: inherit')
+
+  // the final "%c" is somewhat tricky, because there could be other
+  // arguments passed either before or after the %c, so we need to
+  // figure out the correct index to insert the CSS into
+  var index = 0;
+  var lastC = 0;
+  args[0].replace(/%[a-zA-Z%]/g, function(match) {
+    if ('%%' === match) return;
+    index++;
+    if ('%c' === match) {
+      // we only are interested in the *last* %c
+      // (the user may have provided their own)
+      lastC = index;
+    }
+  });
+
+  args.splice(lastC, 0, c);
+}
+
+/**
+ * Invokes `console.log()` when available.
+ * No-op when `console.log` is not a "function".
+ *
+ * @api public
+ */
+
+function log() {
+  // this hackery is required for IE8/9, where
+  // the `console.log` function doesn't have 'apply'
+  return 'object' === typeof console
+    && console.log
+    && Function.prototype.apply.call(console.log, console, arguments);
+}
+
+/**
+ * Save `namespaces`.
+ *
+ * @param {String} namespaces
+ * @api private
+ */
+
+function save(namespaces) {
+  try {
+    if (null == namespaces) {
+      exports.storage.removeItem('debug');
+    } else {
+      exports.storage.debug = namespaces;
+    }
+  } catch(e) {}
+}
+
+/**
+ * Load `namespaces`.
+ *
+ * @return {String} returns the previously persisted debug modes
+ * @api private
+ */
+
+function load() {
+  var r;
+  try {
+    r = exports.storage.debug;
+  } catch(e) {}
+
+  // If debug isn't set in LS, and we're in Electron, try to load $DEBUG
+  if (!r && typeof process !== 'undefined' && 'env' in process) {
+    r = process.env.DEBUG;
+  }
+
+  return r;
+}
+
+/**
+ * Enable namespaces listed in `localStorage.debug` initially.
+ */
+
+exports.enable(load());
+
+/**
+ * Localstorage attempts to return the localstorage.
+ *
+ * This is necessary because safari throws
+ * when a user disables cookies/localstorage
+ * and you attempt to access it.
+ *
+ * @return {LocalStorage}
+ * @api private
+ */
+
+function localstorage() {
+  try {
+    return window.localStorage;
+  } catch (e) {}
+}

express-server/node_modules/cookie-session/node_modules/debug/src/debug.js

@@ -0,0 +1,225 @@
+
+/**
+ * This is the common logic for both the Node.js and web browser
+ * implementations of `debug()`.
+ *
+ * Expose `debug()` as the module.
+ */
+
+exports = module.exports = createDebug.debug = createDebug['default'] = createDebug;
+exports.coerce = coerce;
+exports.disable = disable;
+exports.enable = enable;
+exports.enabled = enabled;
+exports.humanize = require('ms');
+
+/**
+ * Active `debug` instances.
+ */
+exports.instances = [];
+
+/**
+ * The currently active debug mode names, and names to skip.
+ */
+
+exports.names = [];
+exports.skips = [];
+
+/**
+ * Map of special "%n" handling functions, for the debug "format" argument.
+ *
+ * Valid key names are a single, lower or upper-case letter, i.e. "n" and "N".
+ */
+
+exports.formatters = {};
+
+/**
+ * Select a color.
+ * @param {String} namespace
+ * @return {Number}
+ * @api private
+ */
+
+function selectColor(namespace) {
+  var hash = 0, i;
+
+  for (i in namespace) {
+    hash  = ((hash << 5) - hash) + namespace.charCodeAt(i);
+    hash |= 0; // Convert to 32bit integer
+  }
+
+  return exports.colors[Math.abs(hash) % exports.colors.length];
+}
+
+/**
+ * Create a debugger with the given `namespace`.
+ *
+ * @param {String} namespace
+ * @return {Function}
+ * @api public
+ */
+
+function createDebug(namespace) {
+
+  var prevTime;
+
+  function debug() {
+    // disabled?
+    if (!debug.enabled) return;
+
+    var self = debug;
+
+    // set `diff` timestamp
+    var curr = +new Date();
+    var ms = curr - (prevTime || curr);
+    self.diff = ms;
+    self.prev = prevTime;
+    self.curr = curr;
+    prevTime = curr;
+
+    // turn the `arguments` into a proper Array
+    var args = new Array(arguments.length);
+    for (var i = 0; i < args.length; i++) {
+      args[i] = arguments[i];
+    }
+
+    args[0] = exports.coerce(args[0]);
+
+    if ('string' !== typeof args[0]) {
+      // anything else let's inspect with %O
+      args.unshift('%O');
+    }
+
+    // apply any `formatters` transformations
+    var index = 0;
+    args[0] = args[0].replace(/%([a-zA-Z%])/g, function(match, format) {
+      // if we encounter an escaped % then don't increase the array index
+      if (match === '%%') return match;
+      index++;
+      var formatter = exports.formatters[format];
+      if ('function' === typeof formatter) {
+        var val = args[index];
+        match = formatter.call(self, val);
+
+        // now we need to remove `args[index]` since it's inlined in the `format`
+        args.splice(index, 1);
+        index--;
+      }
+      return match;
+    });
+
+    // apply env-specific formatting (colors, etc.)
+    exports.formatArgs.call(self, args);
+
+    var logFn = debug.log || exports.log || console.log.bind(console);
+    logFn.apply(self, args);
+  }
+
+  debug.namespace = namespace;
+  debug.enabled = exports.enabled(namespace);
+  debug.useColors = exports.useColors();
+  debug.color = selectColor(namespace);
+  debug.destroy = destroy;
+
+  // env-specific initialization logic for debug instances
+  if ('function' === typeof exports.init) {
+    exports.init(debug);
+  }
+
+  exports.instances.push(debug);
+
+  return debug;
+}
+
+function destroy () {
+  var index = exports.instances.indexOf(this);
+  if (index !== -1) {
+    exports.instances.splice(index, 1);
+    return true;
+  } else {
+    return false;
+  }
+}
+
+/**
+ * Enables a debug mode by namespaces. This can include modes
+ * separated by a colon and wildcards.
+ *
+ * @param {String} namespaces
+ * @api public
+ */
+
+function enable(namespaces) {
+  exports.save(namespaces);
+
+  exports.names = [];
+  exports.skips = [];
+
+  var i;
+  var split = (typeof namespaces === 'string' ? namespaces : '').split(/[\s,]+/);
+  var len = split.length;
+
+  for (i = 0; i < len; i++) {
+    if (!split[i]) continue; // ignore empty strings
+    namespaces = split[i].replace(/\*/g, '.*?');
+    if (namespaces[0] === '-') {
+      exports.skips.push(new RegExp('^' + namespaces.substr(1) + '$'));
+    } else {
+      exports.names.push(new RegExp('^' + namespaces + '$'));
+    }
+  }
+
+  for (i = 0; i < exports.instances.length; i++) {
+    var instance = exports.instances[i];
+    instance.enabled = exports.enabled(instance.namespace);
+  }
+}
+
+/**
+ * Disable debug output.
+ *
+ * @api public
+ */
+
+function disable() {
+  exports.enable('');
+}
+
+/**
+ * Returns true if the given mode name is enabled, false otherwise.
+ *
+ * @param {String} name
+ * @return {Boolean}
+ * @api public
+ */
+
+function enabled(name) {
+  if (name[name.length - 1] === '*') {
+    return true;
+  }
+  var i, len;
+  for (i = 0, len = exports.skips.length; i < len; i++) {
+    if (exports.skips[i].test(name)) {
+      return false;
+    }
+  }
+  for (i = 0, len = exports.names.length; i < len; i++) {
+    if (exports.names[i].test(name)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Coerce `val`.
+ *
+ * @param {Mixed} val
+ * @return {Mixed}
+ * @api private
+ */
+
+function coerce(val) {
+  if (val instanceof Error) return val.stack || val.message;
+  return val;
+}

express-server/node_modules/cookie-session/node_modules/debug/src/index.js

@@ -0,0 +1,10 @@
+/**
+ * Detect Electron renderer process, which is node, but we should
+ * treat as a browser.
+ */
+
+if (typeof process === 'undefined' || process.type === 'renderer') {
+  module.exports = require('./browser.js');
+} else {
+  module.exports = require('./node.js');
+}

express-server/node_modules/cookie-session/node_modules/debug/src/node.js

@@ -0,0 +1,186 @@
+/**
+ * Module dependencies.
+ */
+
+var tty = require('tty');
+var util = require('util');
+
+/**
+ * This is the Node.js implementation of `debug()`.
+ *
+ * Expose `debug()` as the module.
+ */
+
+exports = module.exports = require('./debug');
+exports.init = init;
+exports.log = log;
+exports.formatArgs = formatArgs;
+exports.save = save;
+exports.load = load;
+exports.useColors = useColors;
+
+/**
+ * Colors.
+ */
+
+exports.colors = [ 6, 2, 3, 4, 5, 1 ];
+
+try {
+  var supportsColor = require('supports-color');
+  if (supportsColor && supportsColor.level >= 2) {
+    exports.colors = [
+      20, 21, 26, 27, 32, 33, 38, 39, 40, 41, 42, 43, 44, 45, 56, 57, 62, 63, 68,
+      69, 74, 75, 76, 77, 78, 79, 80, 81, 92, 93, 98, 99, 112, 113, 128, 129, 134,
+      135, 148, 149, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171,
+      172, 173, 178, 179, 184, 185, 196, 197, 198, 199, 200, 201, 202, 203, 204,
+      205, 206, 207, 208, 209, 214, 215, 220, 221
+    ];
+  }
+} catch (err) {
+  // swallow - we only care if `supports-color` is available; it doesn't have to be.
+}
+
+/**
+ * Build up the default `inspectOpts` object from the environment variables.
+ *
+ *   $ DEBUG_COLORS=no DEBUG_DEPTH=10 DEBUG_SHOW_HIDDEN=enabled node script.js
+ */
+
+exports.inspectOpts = Object.keys(process.env).filter(function (key) {
+  return /^debug_/i.test(key);
+}).reduce(function (obj, key) {
+  // camel-case
+  var prop = key
+    .substring(6)
+    .toLowerCase()
+    .replace(/_([a-z])/g, function (_, k) { return k.toUpperCase() });
+
+  // coerce string value into JS value
+  var val = process.env[key];
+  if (/^(yes|on|true|enabled)$/i.test(val)) val = true;
+  else if (/^(no|off|false|disabled)$/i.test(val)) val = false;
+  else if (val === 'null') val = null;
+  else val = Number(val);
+
+  obj[prop] = val;
+  return obj;
+}, {});
+
+/**
+ * Is stdout a TTY? Colored output is enabled when `true`.
+ */
+
+function useColors() {
+  return 'colors' in exports.inspectOpts
+    ? Boolean(exports.inspectOpts.colors)
+    : tty.isatty(process.stderr.fd);
+}
+
+/**
+ * Map %o to `util.inspect()`, all on a single line.
+ */
+
+exports.formatters.o = function(v) {
+  this.inspectOpts.colors = this.useColors;
+  return util.inspect(v, this.inspectOpts)
+    .split('\n').map(function(str) {
+      return str.trim()
+    }).join(' ');
+};
+
+/**
+ * Map %o to `util.inspect()`, allowing multiple lines if needed.
+ */
+
+exports.formatters.O = function(v) {
+  this.inspectOpts.colors = this.useColors;
+  return util.inspect(v, this.inspectOpts);
+};
+
+/**
+ * Adds ANSI color escape codes if enabled.
+ *
+ * @api public
+ */
+
+function formatArgs(args) {
+  var name = this.namespace;
+  var useColors = this.useColors;
+
+  if (useColors) {
+    var c = this.color;
+    var colorCode = '\u001b[3' + (c < 8 ? c : '8;5;' + c);
+    var prefix = '  ' + colorCode + ';1m' + name + ' ' + '\u001b[0m';
+
+    args[0] = prefix + args[0].split('\n').join('\n' + prefix);
+    args.push(colorCode + 'm+' + exports.humanize(this.diff) + '\u001b[0m');
+  } else {
+    args[0] = getDate() + name + ' ' + args[0];
+  }
+}
+
+function getDate() {
+  if (exports.inspectOpts.hideDate) {
+    return '';
+  } else {
+    return new Date().toISOString() + ' ';
+  }
+}
+
+/**
+ * Invokes `util.format()` with the specified arguments and writes to stderr.
+ */
+
+function log() {
+  return process.stderr.write(util.format.apply(util, arguments) + '\n');
+}
+
+/**
+ * Save `namespaces`.
+ *
+ * @param {String} namespaces
+ * @api private
+ */
+
+function save(namespaces) {
+  if (null == namespaces) {
+    // If you set a process.env field to null or undefined, it gets cast to the
+    // string 'null' or 'undefined'. Just delete instead.
+    delete process.env.DEBUG;
+  } else {
+    process.env.DEBUG = namespaces;
+  }
+}
+
+/**
+ * Load `namespaces`.
+ *
+ * @return {String} returns the previously persisted debug modes
+ * @api private
+ */
+
+function load() {
+  return process.env.DEBUG;
+}
+
+/**
+ * Init logic for `debug` instances.
+ *
+ * Create a new `inspectOpts` object in case `useColors` is set
+ * differently for a particular `debug` instance.
+ */
+
+function init (debug) {
+  debug.inspectOpts = {};
+
+  var keys = Object.keys(exports.inspectOpts);
+  for (var i = 0; i < keys.length; i++) {
+    debug.inspectOpts[keys[i]] = exports.inspectOpts[keys[i]];
+  }
+}
+
+/**
+ * Enable namespaces listed in `process.env.DEBUG` initially.
+ */
+
+exports.enable(load());

express-server/node_modules/cookie-session/node_modules/safe-buffer/.travis.yml

@@ -0,0 +1,7 @@
+language: node_js
+node_js:
+  - 'node'
+  - '5'
+  - '4'
+  - '0.12'
+  - '0.10'

express-server/node_modules/cookie-session/node_modules/safe-buffer/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Feross Aboukhadijeh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

express-server/node_modules/cookie-session/node_modules/safe-buffer/README.md

@@ -0,0 +1,584 @@
+# safe-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]
+
+[travis-image]: https://img.shields.io/travis/feross/safe-buffer/master.svg
+[travis-url]: https://travis-ci.org/feross/safe-buffer
+[npm-image]: https://img.shields.io/npm/v/safe-buffer.svg
+[npm-url]: https://npmjs.org/package/safe-buffer
+[downloads-image]: https://img.shields.io/npm/dm/safe-buffer.svg
+[downloads-url]: https://npmjs.org/package/safe-buffer
+[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg
+[standard-url]: https://standardjs.com
+
+#### Safer Node.js Buffer API
+
+**Use the new Node.js Buffer APIs (`Buffer.from`, `Buffer.alloc`,
+`Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`) in all versions of Node.js.**
+
+**Uses the built-in implementation when available.**
+
+## install
+
+```
+npm install safe-buffer
+```
+
+## usage
+
+The goal of this package is to provide a safe replacement for the node.js `Buffer`.
+
+It's a drop-in replacement for `Buffer`. You can use it by adding one `require` line to
+the top of your node.js modules:
+
+```js
+var Buffer = require('safe-buffer').Buffer
+
+// Existing buffer code will continue to work without issues:
+
+new Buffer('hey', 'utf8')
+new Buffer([1, 2, 3], 'utf8')
+new Buffer(obj)
+new Buffer(16) // create an uninitialized buffer (potentially unsafe)
+
+// But you can use these new explicit APIs to make clear what you want:
+
+Buffer.from('hey', 'utf8') // convert from many types to a Buffer
+Buffer.alloc(16) // create a zero-filled buffer (safe)
+Buffer.allocUnsafe(16) // create an uninitialized buffer (potentially unsafe)
+```
+
+## api
+
+### Class Method: Buffer.from(array)
+<!-- YAML
+added: v3.0.0
+-->
+
+* `array` {Array}
+
+Allocates a new `Buffer` using an `array` of octets.
+
+```js
+const buf = Buffer.from([0x62,0x75,0x66,0x66,0x65,0x72]);
+  // creates a new Buffer containing ASCII bytes
+  // ['b','u','f','f','e','r']
+```
+
+A `TypeError` will be thrown if `array` is not an `Array`.
+
+### Class Method: Buffer.from(arrayBuffer[, byteOffset[, length]])
+<!-- YAML
+added: v5.10.0
+-->
+
+* `arrayBuffer` {ArrayBuffer} The `.buffer` property of a `TypedArray` or
+  a `new ArrayBuffer()`
+* `byteOffset` {Number} Default: `0`
+* `length` {Number} Default: `arrayBuffer.length - byteOffset`
+
+When passed a reference to the `.buffer` property of a `TypedArray` instance,
+the newly created `Buffer` will share the same allocated memory as the
+TypedArray.
+
+```js
+const arr = new Uint16Array(2);
+arr[0] = 5000;
+arr[1] = 4000;
+
+const buf = Buffer.from(arr.buffer); // shares the memory with arr;
+
+console.log(buf);
+  // Prints: <Buffer 88 13 a0 0f>
+
+// changing the TypedArray changes the Buffer also
+arr[1] = 6000;
+
+console.log(buf);
+  // Prints: <Buffer 88 13 70 17>
+```
+
+The optional `byteOffset` and `length` arguments specify a memory range within
+the `arrayBuffer` that will be shared by the `Buffer`.
+
+```js
+const ab = new ArrayBuffer(10);
+const buf = Buffer.from(ab, 0, 2);
+console.log(buf.length);
+  // Prints: 2
+```
+
+A `TypeError` will be thrown if `arrayBuffer` is not an `ArrayBuffer`.
+
+### Class Method: Buffer.from(buffer)
+<!-- YAML
+added: v3.0.0
+-->
+
+* `buffer` {Buffer}
+
+Copies the passed `buffer` data onto a new `Buffer` instance.
+
+```js
+const buf1 = Buffer.from('buffer');
+const buf2 = Buffer.from(buf1);
+
+buf1[0] = 0x61;
+console.log(buf1.toString());
+  // 'auffer'
+console.log(buf2.toString());
+  // 'buffer' (copy is not changed)
+```
+
+A `TypeError` will be thrown if `buffer` is not a `Buffer`.
+
+### Class Method: Buffer.from(str[, encoding])
+<!-- YAML
+added: v5.10.0
+-->
+
+* `str` {String} String to encode.
+* `encoding` {String} Encoding to use, Default: `'utf8'`
+
+Creates a new `Buffer` containing the given JavaScript string `str`. If
+provided, the `encoding` parameter identifies the character encoding.
+If not provided, `encoding` defaults to `'utf8'`.
+
+```js
+const buf1 = Buffer.from('this is a tést');
+console.log(buf1.toString());
+  // prints: this is a tést
+console.log(buf1.toString('ascii'));
+  // prints: this is a tC)st
+
+const buf2 = Buffer.from('7468697320697320612074c3a97374', 'hex');
+console.log(buf2.toString());
+  // prints: this is a tést
+```
+
+A `TypeError` will be thrown if `str` is not a string.
+
+### Class Method: Buffer.alloc(size[, fill[, encoding]])
+<!-- YAML
+added: v5.10.0
+-->
+
+* `size` {Number}
+* `fill` {Value} Default: `undefined`
+* `encoding` {String} Default: `utf8`
+
+Allocates a new `Buffer` of `size` bytes. If `fill` is `undefined`, the
+`Buffer` will be *zero-filled*.
+
+```js
+const buf = Buffer.alloc(5);
+console.log(buf);
+  // <Buffer 00 00 00 00 00>
+```
+
+The `size` must be less than or equal to the value of
+`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is
+`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will
+be created if a `size` less than or equal to 0 is specified.
+
+If `fill` is specified, the allocated `Buffer` will be initialized by calling
+`buf.fill(fill)`. See [`buf.fill()`][] for more information.
+
+```js
+const buf = Buffer.alloc(5, 'a');
+console.log(buf);
+  // <Buffer 61 61 61 61 61>
+```
+
+If both `fill` and `encoding` are specified, the allocated `Buffer` will be
+initialized by calling `buf.fill(fill, encoding)`. For example:
+
+```js
+const buf = Buffer.alloc(11, 'aGVsbG8gd29ybGQ=', 'base64');
+console.log(buf);
+  // <Buffer 68 65 6c 6c 6f 20 77 6f 72 6c 64>
+```
+
+Calling `Buffer.alloc(size)` can be significantly slower than the alternative
+`Buffer.allocUnsafe(size)` but ensures that the newly created `Buffer` instance
+contents will *never contain sensitive data*.
+
+A `TypeError` will be thrown if `size` is not a number.
+
+### Class Method: Buffer.allocUnsafe(size)
+<!-- YAML
+added: v5.10.0
+-->
+
+* `size` {Number}
+
+Allocates a new *non-zero-filled* `Buffer` of `size` bytes.  The `size` must
+be less than or equal to the value of `require('buffer').kMaxLength` (on 64-bit
+architectures, `kMaxLength` is `(2^31)-1`). Otherwise, a [`RangeError`][] is
+thrown. A zero-length Buffer will be created if a `size` less than or equal to
+0 is specified.
+
+The underlying memory for `Buffer` instances created in this way is *not
+initialized*. The contents of the newly created `Buffer` are unknown and
+*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such
+`Buffer` instances to zeroes.
+
+```js
+const buf = Buffer.allocUnsafe(5);
+console.log(buf);
+  // <Buffer 78 e0 82 02 01>
+  // (octets will be different, every time)
+buf.fill(0);
+console.log(buf);
+  // <Buffer 00 00 00 00 00>
+```
+
+A `TypeError` will be thrown if `size` is not a number.
+
+Note that the `Buffer` module pre-allocates an internal `Buffer` instance of
+size `Buffer.poolSize` that is used as a pool for the fast allocation of new
+`Buffer` instances created using `Buffer.allocUnsafe(size)` (and the deprecated
+`new Buffer(size)` constructor) only when `size` is less than or equal to
+`Buffer.poolSize >> 1` (floor of `Buffer.poolSize` divided by two). The default
+value of `Buffer.poolSize` is `8192` but can be modified.
+
+Use of this pre-allocated internal memory pool is a key difference between
+calling `Buffer.alloc(size, fill)` vs. `Buffer.allocUnsafe(size).fill(fill)`.
+Specifically, `Buffer.alloc(size, fill)` will *never* use the internal Buffer
+pool, while `Buffer.allocUnsafe(size).fill(fill)` *will* use the internal
+Buffer pool if `size` is less than or equal to half `Buffer.poolSize`. The
+difference is subtle but can be important when an application requires the
+additional performance that `Buffer.allocUnsafe(size)` provides.
+
+### Class Method: Buffer.allocUnsafeSlow(size)
+<!-- YAML
+added: v5.10.0
+-->
+
+* `size` {Number}
+
+Allocates a new *non-zero-filled* and non-pooled `Buffer` of `size` bytes.  The
+`size` must be less than or equal to the value of
+`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is
+`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will
+be created if a `size` less than or equal to 0 is specified.
+
+The underlying memory for `Buffer` instances created in this way is *not
+initialized*. The contents of the newly created `Buffer` are unknown and
+*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such
+`Buffer` instances to zeroes.
+
+When using `Buffer.allocUnsafe()` to allocate new `Buffer` instances,
+allocations under 4KB are, by default, sliced from a single pre-allocated
+`Buffer`. This allows applications to avoid the garbage collection overhead of
+creating many individually allocated Buffers. This approach improves both
+performance and memory usage by eliminating the need to track and cleanup as
+many `Persistent` objects.
+
+However, in the case where a developer may need to retain a small chunk of
+memory from a pool for an indeterminate amount of time, it may be appropriate
+to create an un-pooled Buffer instance using `Buffer.allocUnsafeSlow()` then
+copy out the relevant bits.
+
+```js
+// need to keep around a few small chunks of memory
+const store = [];
+
+socket.on('readable', () => {
+  const data = socket.read();
+  // allocate for retained data
+  const sb = Buffer.allocUnsafeSlow(10);
+  // copy the data into the new allocation
+  data.copy(sb, 0, 0, 10);
+  store.push(sb);
+});
+```
+
+Use of `Buffer.allocUnsafeSlow()` should be used only as a last resort *after*
+a developer has observed undue memory retention in their applications.
+
+A `TypeError` will be thrown if `size` is not a number.
+
+### All the Rest
+
+The rest of the `Buffer` API is exactly the same as in node.js.
+[See the docs](https://nodejs.org/api/buffer.html).
+
+
+## Related links
+
+- [Node.js issue: Buffer(number) is unsafe](https://github.com/nodejs/node/issues/4660)
+- [Node.js Enhancement Proposal: Buffer.from/Buffer.alloc/Buffer.zalloc/Buffer() soft-deprecate](https://github.com/nodejs/node-eps/pull/4)
+
+## Why is `Buffer` unsafe?
+
+Today, the node.js `Buffer` constructor is overloaded to handle many different argument
+types like `String`, `Array`, `Object`, `TypedArrayView` (`Uint8Array`, etc.),
+`ArrayBuffer`, and also `Number`.
+
+The API is optimized for convenience: you can throw any type at it, and it will try to do
+what you want.
+
+Because the Buffer constructor is so powerful, you often see code like this:
+
+```js
+// Convert UTF-8 strings to hex
+function toHex (str) {
+  return new Buffer(str).toString('hex')
+}
+```
+
+***But what happens if `toHex` is called with a `Number` argument?***
+
+### Remote Memory Disclosure
+
+If an attacker can make your program call the `Buffer` constructor with a `Number`
+argument, then they can make it allocate uninitialized memory from the node.js process.
+This could potentially disclose TLS private keys, user data, or database passwords.
+
+When the `Buffer` constructor is passed a `Number` argument, it returns an
+**UNINITIALIZED** block of memory of the specified `size`. When you create a `Buffer` like
+this, you **MUST** overwrite the contents before returning it to the user.
+
+From the [node.js docs](https://nodejs.org/api/buffer.html#buffer_new_buffer_size):
+
+> `new Buffer(size)`
+>
+> - `size` Number
+>
+> The underlying memory for `Buffer` instances created in this way is not initialized.
+> **The contents of a newly created `Buffer` are unknown and could contain sensitive
+> data.** Use `buf.fill(0)` to initialize a Buffer to zeroes.
+
+(Emphasis our own.)
+
+Whenever the programmer intended to create an uninitialized `Buffer` you often see code
+like this:
+
+```js
+var buf = new Buffer(16)
+
+// Immediately overwrite the uninitialized buffer with data from another buffer
+for (var i = 0; i < buf.length; i++) {
+  buf[i] = otherBuf[i]
+}
+```
+
+
+### Would this ever be a problem in real code?
+
+Yes. It's surprisingly common to forget to check the type of your variables in a
+dynamically-typed language like JavaScript.
+
+Usually the consequences of assuming the wrong type is that your program crashes with an
+uncaught exception. But the failure mode for forgetting to check the type of arguments to
+the `Buffer` constructor is more catastrophic.
+
+Here's an example of a vulnerable service that takes a JSON payload and converts it to
+hex:
+
+```js
+// Take a JSON payload {str: "some string"} and convert it to hex
+var server = http.createServer(function (req, res) {
+  var data = ''
+  req.setEncoding('utf8')
+  req.on('data', function (chunk) {
+    data += chunk
+  })
+  req.on('end', function () {
+    var body = JSON.parse(data)
+    res.end(new Buffer(body.str).toString('hex'))
+  })
+})
+
+server.listen(8080)
+```
+
+In this example, an http client just has to send:
+
+```json
+{
+  "str": 1000
+}
+```
+
+and it will get back 1,000 bytes of uninitialized memory from the server.
+
+This is a very serious bug. It's similar in severity to the
+[the Heartbleed bug](http://heartbleed.com/) that allowed disclosure of OpenSSL process
+memory by remote attackers.
+
+
+### Which real-world packages were vulnerable?
+
+#### [`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht)
+
+[Mathias Buus](https://github.com/mafintosh) and I
+([Feross Aboukhadijeh](http://feross.org/)) found this issue in one of our own packages,
+[`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht). The bug would allow
+anyone on the internet to send a series of messages to a user of `bittorrent-dht` and get
+them to reveal 20 bytes at a time of uninitialized memory from the node.js process.
+
+Here's
+[the commit](https://github.com/feross/bittorrent-dht/commit/6c7da04025d5633699800a99ec3fbadf70ad35b8)
+that fixed it. We released a new fixed version, created a
+[Node Security Project disclosure](https://nodesecurity.io/advisories/68), and deprecated all
+vulnerable versions on npm so users will get a warning to upgrade to a newer version.
+
+#### [`ws`](https://www.npmjs.com/package/ws)
+
+That got us wondering if there were other vulnerable packages. Sure enough, within a short
+period of time, we found the same issue in [`ws`](https://www.npmjs.com/package/ws), the
+most popular WebSocket implementation in node.js.
+
+If certain APIs were called with `Number` parameters instead of `String` or `Buffer` as
+expected, then uninitialized server memory would be disclosed to the remote peer.
+
+These were the vulnerable methods:
+
+```js
+socket.send(number)
+socket.ping(number)
+socket.pong(number)
+```
+
+Here's a vulnerable socket server with some echo functionality:
+
+```js
+server.on('connection', function (socket) {
+  socket.on('message', function (message) {
+    message = JSON.parse(message)
+    if (message.type === 'echo') {
+      socket.send(message.data) // send back the user's message
+    }
+  })
+})
+```
+
+`socket.send(number)` called on the server, will disclose server memory.
+
+Here's [the release](https://github.com/websockets/ws/releases/tag/1.0.1) where the issue
+was fixed, with a more detailed explanation. Props to
+[Arnout Kazemier](https://github.com/3rd-Eden) for the quick fix. Here's the
+[Node Security Project disclosure](https://nodesecurity.io/advisories/67).
+
+
+### What's the solution?
+
+It's important that node.js offers a fast way to get memory otherwise performance-critical
+applications would needlessly get a lot slower.
+
+But we need a better way to *signal our intent* as programmers. **When we want
+uninitialized memory, we should request it explicitly.**
+
+Sensitive functionality should not be packed into a developer-friendly API that loosely
+accepts many different types. This type of API encourages the lazy practice of passing
+variables in without checking the type very carefully.
+
+#### A new API: `Buffer.allocUnsafe(number)`
+
+The functionality of creating buffers with uninitialized memory should be part of another
+API. We propose `Buffer.allocUnsafe(number)`. This way, it's not part of an API that
+frequently gets user input of all sorts of different types passed into it.
+
+```js
+var buf = Buffer.allocUnsafe(16) // careful, uninitialized memory!
+
+// Immediately overwrite the uninitialized buffer with data from another buffer
+for (var i = 0; i < buf.length; i++) {
+  buf[i] = otherBuf[i]
+}
+```
+
+
+### How do we fix node.js core?
+
+We sent [a PR to node.js core](https://github.com/nodejs/node/pull/4514) (merged as
+`semver-major`) which defends against one case:
+
+```js
+var str = 16
+new Buffer(str, 'utf8')
+```
+
+In this situation, it's implied that the programmer intended the first argument to be a
+string, since they passed an encoding as a second argument. Today, node.js will allocate
+uninitialized memory in the case of `new Buffer(number, encoding)`, which is probably not
+what the programmer intended.
+
+But this is only a partial solution, since if the programmer does `new Buffer(variable)`
+(without an `encoding` parameter) there's no way to know what they intended. If `variable`
+is sometimes a number, then uninitialized memory will sometimes be returned.
+
+### What's the real long-term fix?
+
+We could deprecate and remove `new Buffer(number)` and use `Buffer.allocUnsafe(number)` when
+we need uninitialized memory. But that would break 1000s of packages.
+
+~~We believe the best solution is to:~~
+
+~~1. Change `new Buffer(number)` to return safe, zeroed-out memory~~
+
+~~2. Create a new API for creating uninitialized Buffers. We propose: `Buffer.allocUnsafe(number)`~~
+
+#### Update
+
+We now support adding three new APIs:
+
+- `Buffer.from(value)` - convert from any type to a buffer
+- `Buffer.alloc(size)` - create a zero-filled buffer
+- `Buffer.allocUnsafe(size)` - create an uninitialized buffer with given size
+
+This solves the core problem that affected `ws` and `bittorrent-dht` which is
+`Buffer(variable)` getting tricked into taking a number argument.
+
+This way, existing code continues working and the impact on the npm ecosystem will be
+minimal. Over time, npm maintainers can migrate performance-critical code to use
+`Buffer.allocUnsafe(number)` instead of `new Buffer(number)`.
+
+
+### Conclusion
+
+We think there's a serious design issue with the `Buffer` API as it exists today. It
+promotes insecure software by putting high-risk functionality into a convenient API
+with friendly "developer ergonomics".
+
+This wasn't merely a theoretical exercise because we found the issue in some of the
+most popular npm packages.
+
+Fortunately, there's an easy fix that can be applied today. Use `safe-buffer` in place of
+`buffer`.
+
+```js
+var Buffer = require('safe-buffer').Buffer
+```
+
+Eventually, we hope that node.js core can switch to this new, safer behavior. We believe
+the impact on the ecosystem would be minimal since it's not a breaking change.
+Well-maintained, popular packages would be updated to use `Buffer.alloc` quickly, while
+older, insecure packages would magically become safe from this attack vector.
+
+
+## links
+
+- [Node.js PR: buffer: throw if both length and enc are passed](https://github.com/nodejs/node/pull/4514)
+- [Node Security Project disclosure for `ws`](https://nodesecurity.io/advisories/67)
+- [Node Security Project disclosure for`bittorrent-dht`](https://nodesecurity.io/advisories/68)
+
+
+## credit
+
+The original issues in `bittorrent-dht`
+([disclosure](https://nodesecurity.io/advisories/68)) and
+`ws` ([disclosure](https://nodesecurity.io/advisories/67)) were discovered by
+[Mathias Buus](https://github.com/mafintosh) and
+[Feross Aboukhadijeh](http://feross.org/).
+
+Thanks to [Adam Baldwin](https://github.com/evilpacket) for helping disclose these issues
+and for his work running the [Node Security Project](https://nodesecurity.io/).
+
+Thanks to [John Hiesey](https://github.com/jhiesey) for proofreading this README and
+auditing the code.
+
+
+## license
+
+MIT. Copyright (C) [Feross Aboukhadijeh](http://feross.org)

express-server/node_modules/cookie-session/node_modules/safe-buffer/index.js

@@ -0,0 +1,62 @@
+/* eslint-disable node/no-deprecated-api */
+var buffer = require('buffer')
+var Buffer = buffer.Buffer
+
+// alternative to using Object.keys for old browsers
+function copyProps (src, dst) {
+  for (var key in src) {
+    dst[key] = src[key]
+  }
+}
+if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {
+  module.exports = buffer
+} else {
+  // Copy properties from require('buffer')
+  copyProps(buffer, exports)
+  exports.Buffer = SafeBuffer
+}
+
+function SafeBuffer (arg, encodingOrOffset, length) {
+  return Buffer(arg, encodingOrOffset, length)
+}
+
+// Copy static methods from Buffer
+copyProps(Buffer, SafeBuffer)
+
+SafeBuffer.from = function (arg, encodingOrOffset, length) {
+  if (typeof arg === 'number') {
+    throw new TypeError('Argument must not be a number')
+  }
+  return Buffer(arg, encodingOrOffset, length)
+}
+
+SafeBuffer.alloc = function (size, fill, encoding) {
+  if (typeof size !== 'number') {
+    throw new TypeError('Argument must be a number')
+  }
+  var buf = Buffer(size)
+  if (fill !== undefined) {
+    if (typeof encoding === 'string') {
+      buf.fill(fill, encoding)
+    } else {
+      buf.fill(fill)
+    }
+  } else {
+    buf.fill(0)
+  }
+  return buf
+}
+
+SafeBuffer.allocUnsafe = function (size) {
+  if (typeof size !== 'number') {
+    throw new TypeError('Argument must be a number')
+  }
+  return Buffer(size)
+}
+
+SafeBuffer.allocUnsafeSlow = function (size) {
+  if (typeof size !== 'number') {
+    throw new TypeError('Argument must be a number')
+  }
+  return buffer.SlowBuffer(size)
+}

express-server/node_modules/cookie-session/node_modules/safe-buffer/package.json

@@ -0,0 +1,62 @@
+{
+  "_from": "safe-buffer@5.1.1",
+  "_id": "safe-buffer@5.1.1",
+  "_inBundle": false,
+  "_integrity": "sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg==",
+  "_location": "/cookie-session/safe-buffer",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "safe-buffer@5.1.1",
+    "name": "safe-buffer",
+    "escapedName": "safe-buffer",
+    "rawSpec": "5.1.1",
+    "saveSpec": null,
+    "fetchSpec": "5.1.1"
+  },
+  "_requiredBy": [
+    "/cookie-session"
+  ],
+  "_resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.1.tgz",
+  "_shasum": "893312af69b2123def71f57889001671eeb2c853",
+  "_spec": "safe-buffer@5.1.1",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\cookie-session",
+  "author": {
+    "name": "Feross Aboukhadijeh",
+    "email": "feross@feross.org",
+    "url": "http://feross.org"
+  },
+  "bugs": {
+    "url": "https://github.com/feross/safe-buffer/issues"
+  },
+  "bundleDependencies": false,
+  "deprecated": false,
+  "description": "Safer Node.js Buffer API",
+  "devDependencies": {
+    "standard": "*",
+    "tape": "^4.0.0",
+    "zuul": "^3.0.0"
+  },
+  "homepage": "https://github.com/feross/safe-buffer",
+  "keywords": [
+    "buffer",
+    "buffer allocate",
+    "node security",
+    "safe",
+    "safe-buffer",
+    "security",
+    "uninitialized"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "name": "safe-buffer",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/feross/safe-buffer.git"
+  },
+  "scripts": {
+    "test": "standard && tape test.js"
+  },
+  "version": "5.1.1"
+}

express-server/node_modules/cookie-session/node_modules/safe-buffer/test.js

@@ -0,0 +1,101 @@
+/* eslint-disable node/no-deprecated-api */
+
+var test = require('tape')
+var SafeBuffer = require('./').Buffer
+
+test('new SafeBuffer(value) works just like Buffer', function (t) {
+  t.deepEqual(new SafeBuffer('hey'), new Buffer('hey'))
+  t.deepEqual(new SafeBuffer('hey', 'utf8'), new Buffer('hey', 'utf8'))
+  t.deepEqual(new SafeBuffer('686579', 'hex'), new Buffer('686579', 'hex'))
+  t.deepEqual(new SafeBuffer([1, 2, 3]), new Buffer([1, 2, 3]))
+  t.deepEqual(new SafeBuffer(new Uint8Array([1, 2, 3])), new Buffer(new Uint8Array([1, 2, 3])))
+
+  t.equal(typeof SafeBuffer.isBuffer, 'function')
+  t.equal(SafeBuffer.isBuffer(new SafeBuffer('hey')), true)
+  t.equal(Buffer.isBuffer(new SafeBuffer('hey')), true)
+  t.notOk(SafeBuffer.isBuffer({}))
+
+  t.end()
+})
+
+test('SafeBuffer.from(value) converts to a Buffer', function (t) {
+  t.deepEqual(SafeBuffer.from('hey'), new Buffer('hey'))
+  t.deepEqual(SafeBuffer.from('hey', 'utf8'), new Buffer('hey', 'utf8'))
+  t.deepEqual(SafeBuffer.from('686579', 'hex'), new Buffer('686579', 'hex'))
+  t.deepEqual(SafeBuffer.from([1, 2, 3]), new Buffer([1, 2, 3]))
+  t.deepEqual(SafeBuffer.from(new Uint8Array([1, 2, 3])), new Buffer(new Uint8Array([1, 2, 3])))
+
+  t.end()
+})
+
+test('SafeBuffer.alloc(number) returns zeroed-out memory', function (t) {
+  for (var i = 0; i < 10; i++) {
+    var expected1 = new Buffer(1000)
+    expected1.fill(0)
+    t.deepEqual(SafeBuffer.alloc(1000), expected1)
+
+    var expected2 = new Buffer(1000 * 1000)
+    expected2.fill(0)
+    t.deepEqual(SafeBuffer.alloc(1000 * 1000), expected2)
+  }
+  t.end()
+})
+
+test('SafeBuffer.allocUnsafe(number)', function (t) {
+  var buf = SafeBuffer.allocUnsafe(100) // unitialized memory
+  t.equal(buf.length, 100)
+  t.equal(SafeBuffer.isBuffer(buf), true)
+  t.equal(Buffer.isBuffer(buf), true)
+  t.end()
+})
+
+test('SafeBuffer.from() throws with number types', function (t) {
+  t.plan(5)
+  t.throws(function () {
+    SafeBuffer.from(0)
+  })
+  t.throws(function () {
+    SafeBuffer.from(-1)
+  })
+  t.throws(function () {
+    SafeBuffer.from(NaN)
+  })
+  t.throws(function () {
+    SafeBuffer.from(Infinity)
+  })
+  t.throws(function () {
+    SafeBuffer.from(99)
+  })
+})
+
+test('SafeBuffer.allocUnsafe() throws with non-number types', function (t) {
+  t.plan(4)
+  t.throws(function () {
+    SafeBuffer.allocUnsafe('hey')
+  })
+  t.throws(function () {
+    SafeBuffer.allocUnsafe('hey', 'utf8')
+  })
+  t.throws(function () {
+    SafeBuffer.allocUnsafe([1, 2, 3])
+  })
+  t.throws(function () {
+    SafeBuffer.allocUnsafe({})
+  })
+})
+
+test('SafeBuffer.alloc() throws with non-number types', function (t) {
+  t.plan(4)
+  t.throws(function () {
+    SafeBuffer.alloc('hey')
+  })
+  t.throws(function () {
+    SafeBuffer.alloc('hey', 'utf8')
+  })
+  t.throws(function () {
+    SafeBuffer.alloc([1, 2, 3])
+  })
+  t.throws(function () {
+    SafeBuffer.alloc({})
+  })
+})

express-server/node_modules/cookie-session/package.json

@@ -0,0 +1,93 @@
+{
+  "_from": "cookie-session",
+  "_id": "cookie-session@2.0.0-beta.3",
+  "_inBundle": false,
+  "_integrity": "sha512-zyqm5tA0z9yMEB/xyP7lnRnqp8eLR2e0dap+9+rBwVigla9yPKn8XTL1jJymog8xjfrowqW2o5LUjixQChkqrw==",
+  "_location": "/cookie-session",
+  "_phantomChildren": {
+    "ms": "2.0.0"
+  },
+  "_requested": {
+    "type": "tag",
+    "registry": true,
+    "raw": "cookie-session",
+    "name": "cookie-session",
+    "escapedName": "cookie-session",
+    "rawSpec": "",
+    "saveSpec": null,
+    "fetchSpec": "latest"
+  },
+  "_requiredBy": [
+    "#USER",
+    "/"
+  ],
+  "_resolved": "https://registry.npmjs.org/cookie-session/-/cookie-session-2.0.0-beta.3.tgz",
+  "_shasum": "4e446bd9f85bd7e27d3e226f4e99af12011a4386",
+  "_spec": "cookie-session",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server",
+  "bugs": {
+    "url": "https://github.com/expressjs/cookie-session/issues"
+  },
+  "bundleDependencies": false,
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "Jonathan Ong",
+      "email": "me@jongleberry.com",
+      "url": "http://jongleberry.com"
+    }
+  ],
+  "dependencies": {
+    "cookies": "0.7.1",
+    "debug": "3.1.0",
+    "on-headers": "~1.0.1",
+    "safe-buffer": "5.1.1"
+  },
+  "deprecated": false,
+  "description": "cookie session middleware",
+  "devDependencies": {
+    "connect": "3.6.5",
+    "eslint": "3.19.0",
+    "eslint-config-standard": "10.2.1",
+    "eslint-plugin-import": "2.7.0",
+    "eslint-plugin-markdown": "1.0.0-beta.6",
+    "eslint-plugin-node": "5.2.0",
+    "eslint-plugin-promise": "3.5.0",
+    "eslint-plugin-standard": "3.0.1",
+    "mocha": "3.5.3",
+    "nyc": "10.3.2",
+    "supertest": "1.2.0"
+  },
+  "engines": {
+    "node": ">= 0.10"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "homepage": "https://github.com/expressjs/cookie-session#readme",
+  "keywords": [
+    "connect",
+    "express",
+    "middleware",
+    "session"
+  ],
+  "license": "MIT",
+  "name": "cookie-session",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/expressjs/cookie-session.git"
+  },
+  "scripts": {
+    "lint": "eslint --plugin markdown --ext js,md .",
+    "test": "mocha --check-leaks --reporter spec --bail test/",
+    "test-ci": "nyc --reporter=text npm test",
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
+  },
+  "version": "2.0.0-beta.3"
+}

express-server/node_modules/cookies/HISTORY.md

@@ -0,0 +1,97 @@
+0.7.1 / 2017-08-26
+==================
+
+  * deps: depd@~1.1.1
+    - Remove unnecessary `Buffer` loading
+  * deps: keygrip@~1.0.2
+    - perf: improve comparison speed
+
+0.7.0 / 2017-02-19
+==================
+
+  * Add `sameSite` option for SameSite cookie support
+  * pref: enable strict mode
+
+0.6.2 / 2016-11-12
+==================
+
+  * Fix `keys` deprecation message
+  * deps: keygrip@~1.0.1
+
+0.6.1 / 2016-02-29
+==================
+
+  * Fix regression in 0.6.0 for array of strings in `keys` option
+
+0.6.0 / 2016-02-29
+==================
+
+  * Add `secure` constructor option for secure connection checking
+  * Change constructor to signature `new Cookies(req, res, [options])`
+    - Replace `new Cookies(req, res, key)` with `new Cookies(req, res, {'keys': keys})`
+  * Change prototype construction for proper "constructor" property
+  * Deprecate `secureProxy` option in `.set`; use `secure` option instead
+    - If `secure: true` throws even over SSL, use the `secure` constructor option
+
+0.5.1 / 2014-07-27
+==================
+
+  * Throw on invalid values provided to `Cookie` constructor
+    - This is not strict validation, but basic RFC 7230 validation
+
+0.5.0 / 2014-07-27
+==================
+
+  * Integrate with `req.protocol` for secure cookies
+  * Support `maxAge` as well as `maxage`
+
+0.4.1 / 2014-05-07
+==================
+
+  * Update package for repo move
+
+0.4.0 / 2014-01-31
+==================
+
+  * Allow passing an array of strings as keys
+
+0.3.8-0.2.0
+===========
+
+  * TODO: write down history for these releases
+
+0.1.6 / 2011-03-01
+==================
+
+  * SSL cookies secure by default
+  * Use httpOnly by default unless explicitly false
+
+0.1.5 / 2011-02-26
+==================
+
+  * Delete sig cookie if signed cookie is deleted
+
+0.1.4 / 2011-02-26
+==================
+
+  * Always set path
+
+0.1.3 / 2011-02-26
+==================
+
+  * Add sensible defaults for path
+
+0.1.2 / 2011-02-26
+==================
+
+  * Inherit cookie properties to signature cookie
+
+0.1.1 / 2011-02-25
+==================
+
+  * Readme updates
+
+0.1.0 / 2011-02-25
+==================
+
+  * Initial release

express-server/node_modules/cookies/LICENSE

@@ -0,0 +1,23 @@
+(The MIT License)
+
+Copyright (c) 2014 Jed Schmidt, http://jed.is/
+Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

express-server/node_modules/cookies/README.md

@@ -0,0 +1,158 @@
+Cookies
+=======
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Cookies is a [node.js](http://nodejs.org/) module for getting and setting HTTP(S) cookies. Cookies can be signed to prevent tampering, using [Keygrip](https://www.npmjs.com/package/keygrip). It can be used with the built-in node.js HTTP library, or as Connect/Express middleware.
+
+## Install
+
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/). Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
+```
+$ npm install cookies
+```
+
+## Features
+
+* **Lazy**: Since cookie verification against multiple keys could be expensive, cookies are only verified lazily when accessed, not eagerly on each request.
+
+* **Secure**: All cookies are `httponly` by default, and cookies sent over SSL are `secure` by default. An error will be thrown if you try to send secure cookies over an insecure socket.
+
+* **Unobtrusive**: Signed cookies are stored the same way as unsigned cookies, instead of in an obfuscated signing format. An additional signature cookie is stored for each signed cookie, using a standard naming convention (_cookie-name_`.sig`). This allows other libraries to access the original cookies without having to know the signing mechanism.
+
+* **Agnostic**: This library is optimized for use with [Keygrip](https://www.npmjs.com/package/keygrip), but does not require it; you can implement your own signing scheme instead if you like and use this library only to read/write cookies. Factoring the signing into a separate library encourages code reuse and allows you to use the same signing library for other areas where signing is needed, such as in URLs.
+
+## API
+
+### cookies = new Cookies( request, response, [ options ] )
+
+This creates a cookie jar corresponding to the current _request_ and _response_, additionally passing an object _options_.
+
+A [Keygrip](https://www.npmjs.com/package/keygrip) object or an array of keys can optionally be passed as _options.keys_ to enable cryptographic signing based on SHA1 HMAC, using rotated credentials.
+
+A Boolean can optionally be passed as _options.secure_ to explicitally specify if the connection is secure, rather than this module examining _request_.
+
+Note that since this only saves parameters without any other processing, it is very lightweight. Cookies are only parsed on demand when they are accessed.
+
+### express.createServer( Cookies.express( keys ) )
+
+This adds cookie support as a Connect middleware layer for use in Express apps, allowing inbound cookies to be read using `req.cookies.get` and outbound cookies to be set using `res.cookies.set`.
+
+### cookies.get( name, [ options ] )
+
+This extracts the cookie with the given name from the `Cookie` header in the request. If such a cookie exists, its value is returned. Otherwise, nothing is returned.
+
+`{ signed: true }` can optionally be passed as the second parameter _options_. In this case, a signature cookie (a cookie of same name ending with the `.sig` suffix appended) is fetched. If no such cookie exists, nothing is returned.
+
+If the signature cookie _does_ exist, the provided [Keygrip](https://www.npmjs.com/package/keygrip) object is used to check whether the hash of _cookie-name_=_cookie-value_ matches that of any registered key:
+
+* If the signature cookie hash matches the first key, the original cookie value is returned.
+* If the signature cookie hash matches any other key, the original cookie value is returned AND an outbound header is set to update the signature cookie's value to the hash of the first key. This enables automatic freshening of signature cookies that have become stale due to key rotation.
+* If the signature cookie hash does not match any key, nothing is returned, and an outbound header with an expired date is used to delete the cookie.
+
+### cookies.set( name, [ value ], [ options ] )
+
+This sets the given cookie in the response and returns the current context to allow chaining.
+
+If the _value_ is omitted, an outbound header with an expired date is used to delete the cookie.
+
+If the _options_ object is provided, it will be used to generate the outbound cookie header as follows:
+
+* `maxAge`: a number representing the milliseconds from `Date.now()` for expiry
+* `expires`: a `Date` object indicating the cookie's expiration date (expires at the end of session by default).
+* `path`: a string indicating the path of the cookie (`/` by default).
+* `domain`: a string indicating the domain of the cookie (no default).
+* `secure`: a boolean indicating whether the cookie is only to be sent over HTTPS (`false` by default for HTTP, `true` by default for HTTPS). [Read more about this option below](#secure-cookies).
+* `httpOnly`: a boolean indicating whether the cookie is only to be sent over HTTP(S), and not made available to client JavaScript (`true` by default).
+* `sameSite`: a boolean or string indicating whether the cookie is a "same site" cookie (`false` by default). This can be set to `'strict'`, `'lax'`, or `true` (which maps to `'strict'`).
+* `signed`: a boolean indicating whether the cookie is to be signed (`false` by default). If this is true, another cookie of the same name with the `.sig` suffix appended will also be sent, with a 27-byte url-safe base64 SHA1 value representing the hash of _cookie-name_=_cookie-value_ against the first [Keygrip](https://www.npmjs.com/package/keygrip) key. This signature key is used to detect tampering the next time a cookie is received.
+* `overwrite`: a boolean indicating whether to overwrite previously set cookies of the same name (`false` by default). If this is true, all cookies set during the same request with the same name (regardless of path or domain) are filtered out of the Set-Cookie header when setting this cookie.
+
+### Secure cookies
+
+To send a secure cookie, you set a cookie with the `secure: true` option.
+
+HTTPS is necessary for secure cookies. When `cookies.set` is called with `secure: true` and a secure connection is not detected, the cookie will not be set and an error will be thrown.
+
+This module will test each request to see if it's secure by checking:
+
+* if the `protocol` property of the request is set to `https`, or
+* if the `connection.encrypted` property of the request is set to `true`.
+
+If your server is running behind a proxy and you are using `secure: true`, you need to configure your server to read the request headers added by your proxy to determine whether the request is using a secure connection.
+
+For more information about working behind proxies, consult the framework you are using:
+
+* For Koa - [`app.proxy = true`](http://koajs.com/#settings)
+* For Express - [trust proxy setting](http://expressjs.com/en/4x/api.html#trust.proxy.options.table)
+
+If your Koa or Express server is properly configured, the `protocol` property of the request will be set to match the protocol reported by the proxy in the `X-Forwarded-Proto` header.
+
+## Example
+
+```javascript
+var http    = require( "http" )
+var Cookies = require( "cookies" )
+
+server = http.createServer( function( req, res ) {
+  var cookies = new Cookies( req, res, { "keys": keys } )
+    , unsigned, signed, tampered
+
+  if ( req.url == "/set" ) {
+    cookies
+      // set a regular cookie
+      .set( "unsigned", "foo", { httpOnly: false } )
+
+      // set a signed cookie
+      .set( "signed", "bar", { signed: true } )
+
+      // mimic a signed cookie, but with a bogus signature
+      .set( "tampered", "baz" )
+      .set( "tampered.sig", "bogus" )
+
+    res.writeHead( 302, { "Location": "/" } )
+    return res.end( "Now let's check." )
+  }
+
+  unsigned = cookies.get( "unsigned" )
+  signed = cookies.get( "signed", { signed: true } )
+  tampered = cookies.get( "tampered", { signed: true } )
+
+  assert.equal( unsigned, "foo" )
+  assert.equal( signed, "bar" )
+  assert.notEqual( tampered, "baz" )
+  assert.equal( tampered, undefined )
+
+  res.writeHead( 200, { "Content-Type": "text/plain" } )
+  res.end(
+    "unsigned expected: foo\n\n" +
+    "unsigned actual: " + unsigned + "\n\n" +
+    "signed expected: bar\n\n" +
+    "signed actual: " + signed + "\n\n" +
+    "tampered expected: undefined\n\n"+
+    "tampered: " + tampered + "\n\n"
+  )
+})
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/cookies.svg
+[npm-url]: https://npmjs.org/package/cookies
+[coveralls-image]: https://img.shields.io/coveralls/pillarjs/cookies/master.svg
+[coveralls-url]: https://coveralls.io/r/pillarjs/cookies?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/cookies.svg
+[downloads-url]: https://npmjs.org/package/cookies
+[node-version-image]: https://img.shields.io/node/v/cookies.svg
+[node-version-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/pillarjs/cookies/master.svg
+[travis-url]: https://travis-ci.org/pillarjs/cookies

express-server/node_modules/cookies/index.js

@@ -0,0 +1,216 @@
+/*!
+ * cookies
+ * Copyright(c) 2014 Jed Schmidt, http://jed.is/
+ * Copyright(c) 2015-2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+var deprecate = require('depd')('cookies')
+var Keygrip = require('keygrip')
+var http = require('http')
+var cache = {}
+
+/**
+ * RegExp to match field-content in RFC 7230 sec 3.2
+ *
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar   = VCHAR / obs-text
+ * obs-text      = %x80-FF
+ */
+
+var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
+
+/**
+ * RegExp to match Same-Site cookie attribute value.
+ */
+
+var sameSiteRegExp = /^(?:lax|strict)$/i
+
+function Cookies(request, response, options) {
+  if (!(this instanceof Cookies)) return new Cookies(request, response, options)
+
+  this.secure = undefined
+  this.request = request
+  this.response = response
+
+  if (options) {
+    if (Array.isArray(options)) {
+      // array of key strings
+      deprecate('"keys" argument; provide using options {"keys": [...]}')
+      this.keys = new Keygrip(options)
+    } else if (options.constructor && options.constructor.name === 'Keygrip') {
+      // any keygrip constructor to allow different versions
+      deprecate('"keys" argument; provide using options {"keys": keygrip}')
+      this.keys = options
+    } else {
+      this.keys = Array.isArray(options.keys) ? new Keygrip(options.keys) : options.keys
+      this.secure = options.secure
+    }
+  }
+}
+
+Cookies.prototype.get = function(name, opts) {
+  var sigName = name + ".sig"
+    , header, match, value, remote, data, index
+    , signed = opts && opts.signed !== undefined ? opts.signed : !!this.keys
+
+  header = this.request.headers["cookie"]
+  if (!header) return
+
+  match = header.match(getPattern(name))
+  if (!match) return
+
+  value = match[1]
+  if (!opts || !signed) return value
+
+  remote = this.get(sigName)
+  if (!remote) return
+
+  data = name + "=" + value
+  if (!this.keys) throw new Error('.keys required for signed cookies');
+  index = this.keys.index(data, remote)
+
+  if (index < 0) {
+    this.set(sigName, null, {path: "/", signed: false })
+  } else {
+    index && this.set(sigName, this.keys.sign(data), { signed: false })
+    return value
+  }
+};
+
+Cookies.prototype.set = function(name, value, opts) {
+  var res = this.response
+    , req = this.request
+    , headers = res.getHeader("Set-Cookie") || []
+    , secure = this.secure !== undefined ? !!this.secure : req.protocol === 'https' || req.connection.encrypted
+    , cookie = new Cookie(name, value, opts)
+    , signed = opts && opts.signed !== undefined ? opts.signed : !!this.keys
+
+  if (typeof headers == "string") headers = [headers]
+
+  if (!secure && opts && opts.secure) {
+    throw new Error('Cannot send secure cookie over unencrypted connection')
+  }
+
+  cookie.secure = secure
+  if (opts && "secure" in opts) cookie.secure = opts.secure
+
+  if (opts && "secureProxy" in opts) {
+    deprecate('"secureProxy" option; use "secure" option, provide "secure" to constructor if needed')
+    cookie.secure = opts.secureProxy
+  }
+
+  headers = pushCookie(headers, cookie)
+
+  if (opts && signed) {
+    if (!this.keys) throw new Error('.keys required for signed cookies');
+    cookie.value = this.keys.sign(cookie.toString())
+    cookie.name += ".sig"
+    headers = pushCookie(headers, cookie)
+  }
+
+  var setHeader = res.set ? http.OutgoingMessage.prototype.setHeader : res.setHeader
+  setHeader.call(res, 'Set-Cookie', headers)
+  return this
+};
+
+function Cookie(name, value, attrs) {
+  if (!fieldContentRegExp.test(name)) {
+    throw new TypeError('argument name is invalid');
+  }
+
+  if (value && !fieldContentRegExp.test(value)) {
+    throw new TypeError('argument value is invalid');
+  }
+
+  value || (this.expires = new Date(0))
+
+  this.name = name
+  this.value = value || ""
+
+  for (var name in attrs) {
+    this[name] = attrs[name]
+  }
+
+  if (this.path && !fieldContentRegExp.test(this.path)) {
+    throw new TypeError('option path is invalid');
+  }
+
+  if (this.domain && !fieldContentRegExp.test(this.domain)) {
+    throw new TypeError('option domain is invalid');
+  }
+
+  if (this.sameSite && this.sameSite !== true && !sameSiteRegExp.test(this.sameSite)) {
+    throw new TypeError('option sameSite is invalid')
+  }
+}
+
+Cookie.prototype.path = "/";
+Cookie.prototype.expires = undefined;
+Cookie.prototype.domain = undefined;
+Cookie.prototype.httpOnly = true;
+Cookie.prototype.sameSite = false;
+Cookie.prototype.secure = false;
+Cookie.prototype.overwrite = false;
+
+Cookie.prototype.toString = function() {
+  return this.name + "=" + this.value
+};
+
+Cookie.prototype.toHeader = function() {
+  var header = this.toString()
+
+  if (this.maxAge) this.expires = new Date(Date.now() + this.maxAge);
+
+  if (this.path     ) header += "; path=" + this.path
+  if (this.expires  ) header += "; expires=" + this.expires.toUTCString()
+  if (this.domain   ) header += "; domain=" + this.domain
+  if (this.sameSite ) header += "; samesite=" + (this.sameSite === true ? 'strict' : this.sameSite.toLowerCase())
+  if (this.secure   ) header += "; secure"
+  if (this.httpOnly ) header += "; httponly"
+
+  return header
+};
+
+// back-compat so maxage mirrors maxAge
+Object.defineProperty(Cookie.prototype, 'maxage', {
+  configurable: true,
+  enumerable: true,
+  get: function () { return this.maxAge },
+  set: function (val) { return this.maxAge = val }
+});
+deprecate.property(Cookie.prototype, 'maxage', '"maxage"; use "maxAge" instead')
+
+function getPattern(name) {
+  if (cache[name]) return cache[name]
+
+  return cache[name] = new RegExp(
+    "(?:^|;) *" +
+    name.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&") +
+    "=([^;]*)"
+  )
+}
+
+function pushCookie(cookies, cookie) {
+  if (cookie.overwrite) {
+    cookies = cookies.filter(function(c) { return c.indexOf(cookie.name+'=') !== 0 })
+  }
+  cookies.push(cookie.toHeader())
+  return cookies
+}
+
+Cookies.connect = Cookies.express = function(keys) {
+  return function(req, res, next) {
+    req.cookies = res.cookies = new Cookies(req, res, {
+      keys: keys
+    })
+
+    next()
+  }
+}
+
+Cookies.Cookie = Cookie
+
+module.exports = Cookies

express-server/node_modules/cookies/package.json

@@ -0,0 +1,75 @@
+{
+  "_from": "cookies@0.7.1",
+  "_id": "cookies@0.7.1",
+  "_inBundle": false,
+  "_integrity": "sha1-fIphX1SBxhq58WyDNzG8uPZjuZs=",
+  "_location": "/cookies",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "cookies@0.7.1",
+    "name": "cookies",
+    "escapedName": "cookies",
+    "rawSpec": "0.7.1",
+    "saveSpec": null,
+    "fetchSpec": "0.7.1"
+  },
+  "_requiredBy": [
+    "/cookie-session"
+  ],
+  "_resolved": "https://registry.npmjs.org/cookies/-/cookies-0.7.1.tgz",
+  "_shasum": "7c8a615f5481c61ab9f16c833731bcb8f663b99b",
+  "_spec": "cookies@0.7.1",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\cookie-session",
+  "author": {
+    "name": "Jed Schmidt",
+    "email": "tr@nslator.jp",
+    "url": "http://jed.is"
+  },
+  "bugs": {
+    "url": "https://github.com/pillarjs/cookies/issues"
+  },
+  "bundleDependencies": false,
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "dependencies": {
+    "depd": "~1.1.1",
+    "keygrip": "~1.0.2"
+  },
+  "deprecated": false,
+  "description": "Cookies, optionally signed using Keygrip.",
+  "devDependencies": {
+    "express": "4.9.8",
+    "istanbul": "0.4.5",
+    "mocha": "2.5.3",
+    "restify": "2.8.1",
+    "supertest": "1.1.0"
+  },
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "homepage": "https://github.com/pillarjs/cookies#readme",
+  "license": "MIT",
+  "name": "cookies",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pillarjs/cookies.git"
+  },
+  "scripts": {
+    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/"
+  },
+  "version": "0.7.1"
+}

express-server/node_modules/ecdsa-sig-formatter/CODEOWNERS

@@ -0,0 +1 @@
+* @omsmith

express-server/node_modules/ecdsa-sig-formatter/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2015 D2L Corporation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

express-server/node_modules/ecdsa-sig-formatter/README.md

@@ -0,0 +1,65 @@
+# ecdsa-sig-formatter
+
+[![Build Status](https://travis-ci.org/Brightspace/node-ecdsa-sig-formatter.svg?branch=master)](https://travis-ci.org/Brightspace/node-ecdsa-sig-formatter) [![Coverage Status](https://coveralls.io/repos/Brightspace/node-ecdsa-sig-formatter/badge.svg)](https://coveralls.io/r/Brightspace/node-ecdsa-sig-formatter)
+
+Translate between JOSE and ASN.1/DER encodings for ECDSA signatures
+
+## Install
+```sh
+npm install ecdsa-sig-formatter --save
+```
+
+## Usage
+```js
+var format = require('ecdsa-sig-formatter');
+
+var derSignature = '..'; // asn.1/DER encoded ecdsa signature
+
+var joseSignature = format.derToJose(derSignature);
+
+```
+
+### API
+
+---
+
+#### `.derToJose(Buffer|String signature, String alg)` -> `String`
+
+Convert the ASN.1/DER encoded signature to a JOSE-style concatenated signature.
+Returns a _base64 url_ encoded `String`.
+
+* If _signature_ is a `String`, it should be _base64_ encoded
+* _alg_ must be one of _ES256_, _ES384_ or _ES512_
+
+---
+
+#### `.joseToDer(Buffer|String signature, String alg)` -> `Buffer`
+
+Convert the JOSE-style concatenated signature to an ASN.1/DER encoded
+signature. Returns a `Buffer`
+
+* If _signature_ is a `String`, it should be _base64 url_ encoded
+* _alg_ must be one of _ES256_, _ES384_ or _ES512_
+
+## Contributing
+
+1. **Fork** the repository. Committing directly against this repository is
+   highly discouraged.
+
+2. Make your modifications in a branch, updating and writing new unit tests
+   as necessary in the `spec` directory.
+
+3. Ensure that all tests pass with `npm test`
+
+4. `rebase` your changes against master. *Do not merge*.
+
+5. Submit a pull request to this repository. Wait for tests to run and someone
+   to chime in.
+
+### Code Style
+
+This repository is configured with [EditorConfig][EditorConfig] and
+[ESLint][ESLint] rules.
+
+[EditorConfig]: http://editorconfig.org/
+[ESLint]: http://eslint.org

express-server/node_modules/ecdsa-sig-formatter/package.json

@@ -0,0 +1,72 @@
+{
+  "_from": "ecdsa-sig-formatter@1.0.10",
+  "_id": "ecdsa-sig-formatter@1.0.10",
+  "_inBundle": false,
+  "_integrity": "sha1-HFlQAPBKiJffuFAAiSoPTDOvhsM=",
+  "_location": "/ecdsa-sig-formatter",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "ecdsa-sig-formatter@1.0.10",
+    "name": "ecdsa-sig-formatter",
+    "escapedName": "ecdsa-sig-formatter",
+    "rawSpec": "1.0.10",
+    "saveSpec": null,
+    "fetchSpec": "1.0.10"
+  },
+  "_requiredBy": [
+    "/jwa"
+  ],
+  "_resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.10.tgz",
+  "_shasum": "1c595000f04a8897dfb85000892a0f4c33af86c3",
+  "_spec": "ecdsa-sig-formatter@1.0.10",
+  "_where": "C:\\Users\\Georg\\GitHub\\SmartShopper\\express-server\\node_modules\\jwa",
+  "author": {
+    "name": "D2L Corporation"
+  },
+  "bugs": {
+    "url": "https://github.com/Brightspace/node-ecdsa-sig-formatter/issues"
+  },
+  "bundleDependencies": false,
+  "dependencies": {
+    "safe-buffer": "^5.0.1"
+  },
+  "deprecated": false,
+  "description": "Translate ECDSA signatures between ASN.1/DER and JOSE-style concatenation",
+  "devDependencies": {
+    "bench": "^0.3.6",
+    "chai": "^3.5.0",
+    "coveralls": "^2.11.9",
+    "eslint": "^2.12.0",
+    "eslint-config-brightspace": "^0.2.1",
+    "istanbul": "^0.4.3",
+    "jwk-to-pem": "^1.2.5",
+    "mocha": "^2.5.3",
+    "native-crypto": "^1.7.0"
+  },
+  "homepage": "https://github.com/Brightspace/node-ecdsa-sig-formatter#readme",
+  "keywords": [
+    "ecdsa",
+    "der",
+    "asn.1",
+    "jwt",
+    "jwa",
+    "jsonwebtoken",
+    "jose"
+  ],
+  "license": "Apache-2.0",
+  "main": "src/ecdsa-sig-formatter.js",
+  "name": "ecdsa-sig-formatter",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/Brightspace/node-ecdsa-sig-formatter.git"
+  },
+  "scripts": {
+    "check-style": "eslint .",
+    "pretest": "npm run check-style",
+    "report-cov": "cat ./coverage/lcov.info | coveralls",
+    "test": "istanbul cover --root src _mocha -- spec"
+  },
+  "version": "1.0.10"
+}

express-server/node_modules/ecdsa-sig-formatter/src/ecdsa-sig-formatter.js

@@ -0,0 +1,187 @@
+'use strict';
+
+var Buffer = require('safe-buffer').Buffer;
+
+var getParamBytesForAlg = require('./param-bytes-for-alg');
+
+var MAX_OCTET = 0x80,
+	CLASS_UNIVERSAL = 0,
+	PRIMITIVE_BIT = 0x20,
+	TAG_SEQ = 0x10,
+	TAG_INT = 0x02,
+	ENCODED_TAG_SEQ = (TAG_SEQ | PRIMITIVE_BIT) | (CLASS_UNIVERSAL << 6),
+	ENCODED_TAG_INT = TAG_INT | (CLASS_UNIVERSAL << 6);
+
+function base64Url(base64) {
+	return base64
+		.replace(/=/g, '')
+		.replace(/\+/g, '-')
+		.replace(/\//g, '_');
+}
+
+function signatureAsBuffer(signature) {
+	if (Buffer.isBuffer(signature)) {
+		return signature;
+	} else if ('string' === typeof signature) {
+		return Buffer.from(signature, 'base64');
+	}
+
+	throw new TypeError('ECDSA signature must be a Base64 string or a Buffer');
+}
+
+function derToJose(signature, alg) {
+	signature = signatureAsBuffer(signature);
+	var paramBytes = getParamBytesForAlg(alg);
+
+	// the DER encoded param should at most be the param size, plus a padding
+	// zero, since due to being a signed integer
+	var maxEncodedParamLength = paramBytes + 1;
+
+	var inputLength = signature.length;
+
+	var offset = 0;
+	if (signature[offset++] !== ENCODED_TAG_SEQ) {
+		throw new Error('Could not find expected "seq"');
+	}
+
+	var seqLength = signature[offset++];
+	if (seqLength === (MAX_OCTET | 1)) {
+		seqLength = signature[offset++];
+	}
+
+	if (inputLength - offset < seqLength) {
+		throw new Error('"seq" specified length of "' + seqLength + '", only "' + (inputLength - offset) + '" remaining');
+	}
+
+	if (signature[offset++] !== ENCODED_TAG_INT) {
+		throw new Error('Could not find expected "int" for "r"');
+	}
+
+	var rLength = signature[offset++];
+
+	if (inputLength - offset - 2 < rLength) {
+		throw new Error('"r" specified length of "' + rLength + '", only "' + (inputLength - offset - 2) + '" available');
+	}
+
+	if (maxEncodedParamLength < rLength) {
+		throw new Error('"r" specified length of "' + rLength + '", max of "' + maxEncodedParamLength + '" is acceptable');
+	}
+
+	var rOffset = offset;
+	offset += rLength;
+
+	if (signature[offset++] !== ENCODED_TAG_INT) {
+		throw new Error('Could not find expected "int" for "s"');
+	}
+
+	var sLength = signature[offset++];
+
+	if (inputLength - offset !== sLength) {
+		throw new Error('"s" specified length of "' + sLength + '", expected "' + (inputLength - offset) + '"');
+	}
+
+	if (maxEncodedParamLength < sLength) {
+		throw new Error('"s" specified length of "' + sLength + '", max of "' + maxEncodedParamLength + '" is acceptable');
+	}
+
+	var sOffset = offset;
+	offset += sLength;
+
+	if (offset !== inputLength) {
+		throw new Error('Expected to consume entire buffer, but "' + (inputLength - offset) + '" bytes remain');
+	}
+
+	var rPadding = paramBytes - rLength,
+		sPadding = paramBytes - sLength;
+
+	var dst = Buffer.allocUnsafe(rPadding + rLength + sPadding + sLength);
+
+	for (offset = 0; offset < rPadding; ++offset) {
+		dst[offset] = 0;
+	}
+	signature.copy(dst, offset, rOffset + Math.max(-rPadding, 0), rOffset + rLength);
+
+	offset = paramBytes;
+
+	for (var o = offset; offset < o + sPadding; ++offset) {
+		dst[offset] = 0;
+	}
+	signature.copy(dst, offset, sOffset + Math.max(-sPadding, 0), sOffset + sLength);
+
+	dst = dst.toString('base64');
+	dst = base64Url(dst);
+
+	return dst;
+}
+
+function countPadding(buf, start, stop) {
+	var padding = 0;
+	while (start + padding < stop && buf[start + padding] === 0) {
+		++padding;
+	}
+
+	var needsSign = buf[start + padding] >= MAX_OCTET;
+	if (needsSign) {
+		--padding;
+	}
+
+	return padding;
+}
+
+function joseToDer(signature, alg) {
+	signature = signatureAsBuffer(signature);
+	var paramBytes = getParamBytesForAlg(alg);
+
+	var signatureBytes = signature.length;
+	if (signatureBytes !== paramBytes * 2) {
+		throw new TypeError('"' + alg + '" signatures must be "' + paramBytes * 2 + '" bytes, saw "' + signatureBytes + '"');
+	}
+
+	var rPadding = countPadding(signature, 0, paramBytes);
+	var sPadding = countPadding(signature, paramBytes, signature.length);
+	var rLength = paramBytes - rPadding;
+	var sLength = paramBytes - sPadding;
+
+	var rsBytes = 1 + 1 + rLength + 1 + 1 + sLength;
+
+	var shortLength = rsBytes < MAX_OCTET;
+
+	var dst = Buffer.allocUnsafe((shortLength ? 2 : 3) + rsBytes);
+
+	var offset = 0;
+	dst[offset++] = ENCODED_TAG_SEQ;
+	if (shortLength) {
+		// Bit 8 has value "0"
+		// bits 7-1 give the length.
+		dst[offset++] = rsBytes;
+	} else {
+		// Bit 8 of first octet has value "1"
+		// bits 7-1 give the number of additional length octets.
+		dst[offset++] = MAX_OCTET	| 1;
+		// length, base 256
+		dst[offset++] = rsBytes & 0xff;
+	}
+	dst[offset++] = ENCODED_TAG_INT;
+	dst[offset++] = rLength;
+	if (rPadding < 0) {
+		dst[offset++] = 0;
+		offset += signature.copy(dst, offset, 0, paramBytes);
+	} else {
+		offset += signature.copy(dst, offset, rPadding, paramBytes);
+	}
+	dst[offset++] = ENCODED_TAG_INT;
+	dst[offset++] = sLength;
+	if (sPadding < 0) {
+		dst[offset++] = 0;
+		signature.copy(dst, offset, paramBytes);
+	} else {
+		signature.copy(dst, offset, paramBytes + sPadding);
+	}
+
+	return dst;
+}
+
+module.exports = {
+	derToJose: derToJose,
+	joseToDer: joseToDer
+};

express-server/node_modules/ecdsa-sig-formatter/src/param-bytes-for-alg.js

@@ -0,0 +1,23 @@
+'use strict';
+
+function getParamSize(keySize) {
+	var result = ((keySize / 8) | 0) + (keySize % 8 === 0 ? 0 : 1);
+	return result;
+}
+
+var paramBytesForAlg = {
+	ES256: getParamSize(256),
+	ES384: getParamSize(384),
+	ES512: getParamSize(521)
+};
+
+function getParamBytesForAlg(alg) {
+	var paramBytes = paramBytesForAlg[alg];
+	if (paramBytes) {
+		return paramBytes;
+	}
+
+	throw new Error('Unknown algorithm "' + alg + '"');
+}
+
+module.exports = getParamBytesForAlg;